Multiple vulnerabilities in PHPShop CMS Free

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in PHPShop CMS Free, which can be exploited to perform cross-site scripting and SQL injection attacks.

1) Cross-Site Scripting in PHPShop CMS Free
1.1 Input appended to the URL after multiple files is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Exploitation example:
http://[host]/phpshop/admpanel/banner/adm_baner_new.php/%22%3E%3Cscript%3Eal ert%28document.cookie%29;%3C/script%3E
http://[host]/phpshop/admpanel/gbook/adm_gbook_new.php/%22%3E%3Cscript%3Eale rt%28document.cookie%29;%3C/script%3E
http://[host]/phpshop/admpanel/links/adm_links_new.php/%22%3E%3Cscript%3Eale rt%28document.cookie%29;%3C/script%3E
http://[host]/phpshop/admpanel/menu/adm_menu_new.php/%22%3E%3Cscript%3Ealert %28document.cookie%29;%3C/script%3E
http://[host]/gbook/?a=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/scri pt%3E
Successful exploitation of this vulnerabilities requires that Apache's directive "AcceptPathInfo" is set to "on" or "default" (default value is "default")
1.2 Input passed via the "pid" GET parameter to /phpshop/admpanel/catalog/admin_cat_content.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/phpshop/admpanel/catalog/admin_cat_content.php?pid=%22%3E%3Csc ript%3Ealert%28document.cookie%29;%3C/script%3E
1.3 Input passed via the "id" GET parameter to /phpshop/admpanel/catalog/adm_catalog_new.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/phpshop/admpanel/catalog/adm_catalog_new.php?id=%%22%3E%3Cscri pt%3Ealert%28document.cookie%29;%3C/script%3E
1.4 Input passed via the "catalogID" GET parameter to /phpshop/admpanel/page/adm_pages_new.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/phpshop/admpanel/page/adm_pages_new.php?catalogID=%22%3E%3Cscr ipt%3Ealert%28document.cookie%29;%3C/script%3E
1.5 Input passed via the "pid" GET parameter to /phpshop/admpanel/photo/admin_photo_content.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/phpshop/admpanel/photo/admin_photo_content.php?pid=%22%3E%3Csc ript%3Ealert%28document.cookie%29;%3C/script%3E
1.6 Input passed via the "log" & "pas" COOKIE parameters to /phpshop/admpanel/ is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
GET /phpshop/admpanel/ HTTP/1.1
Cookie: log="><script>alert(document.cookie)%3b</script>

2) SQL Injection in PHPShop CMS Free
2.1 Input passed via the "id" GET parameter to /phpshop/admpanel/catalog/adm_catalog_new.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/phpshop/admpanel/catalog/adm_catalog_new.php?id=3%20AND%201=1
Successful exploitation of this vulnerability requires that attacker have access to admin panel.

2.2 Input passed via the "pid" GET parameter to /phpshop/admpanel/catalog/admin_cat_content.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/phpshop/admpanel/catalog/admin_cat_content.php?pid=3%20AND%201 =2
Successful exploitation of this vulnerability requires that attacker have access to admin panel.
2.3 Input passed via the "catalogID" GET parameter to /phpshop/admpanel/page/adm_pages_new.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/phpshop/admpanel/page/adm_pages_new.php?catalogID=3%20AND%201= 2
Successful exploitation of this vulnerability requires that attacker have access to admin panel.
2.4 Input passed via the "pid" GET parameter to /phpshop/admpanel/photo/admin_photo_content.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/phpshop/admpanel/photo/admin_photo_content.php?pid=6%20AND%201 =2
Successful exploitation of this vulnerability requires that attacker have access to admin panel.