Multiple Vulnerabilities in miniblog

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in miniblog which could be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerabilities in miniblog
1.1 The vulnerability exists due to input sanitation error in the "post_list" parameter in adm/list.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Successful exploitation requires that that victim is logged-in into the application and has access to administrative interface and that "register_globals" is enabled.
Exploitation example:
http://[host]/adm/list.php?post_list=%3Cscript%3Ealert%28document.cookie%29; %3C/script%3E
1.2 The vulnerability exists due to input sanitation error in the "error_text" parameter in adm/login.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Successful exploitation requires that that victim is logged-in into the application and has access to administrative interface and that "register_globals" is enabled.
Exploitation example:
http://[host]/adm/login.php?error_text=%3Cscript%3Ealert%28document.cookie%2 9;%3C/script%3E
1.3 The vulnerability exists due to input sanitation error in the "response_text" parameter in adm/options.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Successful exploitation requires that that victim is logged-in into the application and has access to administrative interface and that "register_globals" is enabled.
Exploitation example:
http://[host]/adm/options.php?response_text=%3Cscript%3Ealert%28document.coo kie%29;%3C/script%3E
1.4 The vulnerability exists due to input sanitation error in the "response_text" parameter in adm/password.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Successful exploitation requires that that victim is logged-in into the application and has access to administrative interface and that "register_globals" is enabled.
Exploitation example:
http://[host]/adm/password.php?response_text=%3Cscript%3Ealert%28document.co okie%29;%3C/script%3E
1.5 The vulnerability exists due to input sanitation error in the "response_text" and "mode" parameters in adm/edit.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Successful exploitation requires that that victim is logged-in into the application and has access to administrative interface and that "register_globals" is enabled.
Exploitation examples:
http://[host]/adm/edit.php?response_text=%3Cscript%3Ealert%28document.cookie %29;%3C/script%3E
http://[host]/adm/edit.php?mode=%3Cscript%3Ealert%28docum ent.cookie%29;%3C/script%3E

2) Cross-site request forgery in miniblog
The vulnerability exists due to insufficient validation of the request origin. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and create administrative accounts.
Exploitation example:
<form action="http://[host]/adm/admin.php?mode=add&id=" method="post">
<input type="hidden" name="data[post_title]" value="csrf">
<input type="hidden" name="data[post_content]" value="csrf">
<input type="hidden" name="data[published]" value="1">
<input type="hidden" name="miniblog_PostBack" value="Add">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script>