High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in X2CRM, which can be exploited to include arbitrary local files and execute arbitrary PHP code, as well as to perform Cross-Site Sripting (XSS) attacks against users of vulnerable application.
1) PHP File Inclusion in X2CRM: CVE-2013-5692
The vulnerability exists due to insufficient filtration of the "file" HTTP GET parameter passed to "/index.php/admin/translationManager" URL before using it in PHP "include()" function. A remote authenticated administrator can include and execute arbitrary local PHP files on the target system using directory traversal sequences.
The following exploitation example displays content of "/etc/passwd" file:
Successful exploitation of this vulnerability requires administrative privileges, however it can be also exploited via CSRF vector to which the application is prone.
Simple CSRF exploit below includes and executes "/tmp/file.php" script:
<img src="http://[host]/index.php/admin/translationManager?file=../../../../../tm p/file.php">
2) Cross-Site Scripting (XSS) in X2CRM: CVE-2013-5693
The vulnerability exists due to insufficient sanitisation of user-supplied data in "model" HTTP GET parameter passed to "/index.php/admin/editor" URL. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.