CMS WebManager-Pro 7.4.3 Code Execution / Cross Site Request Forgery

`Hello list!  
  
I want to warn you about Remote Code Execution and Cross-Site Request  
Forgery vulnerabilities in CMS WebManager-Pro. This CMS is widely using at  
different web sites, including security and government sites.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are CMS WebManager-Pro v.7.4.3 (version from FGS_Studio) and  
previous versions.  
  
----------  
Details:  
----------  
  
RCE (Remote PHP Code Execution) (WASC-31):  
  
There is possible inclusion of php tags directly in textual fields of  
content in the system. Thus at any page (in field "Text") it's possible to  
put php code, which will execute at visiting of a page. The attack can be  
conducted at access to admin panel, or at CSRF attack on admin.  
  
PHP code is setting in the next way:  
  
<?php include "/etc/passwd"; php?>  
<?php include "script.php"; php?>  
  
CSRF (WASC-09):  
  
In edit_content.php there is not checking source of request, which allows to  
conduct CSRF attacks for changing of content of any site's page. Which also  
can be used for conducting of persistent XSS attacks and for remote code  
execution.  
  
------------  
Timeline:  
------------  
  
2010.11.19 - announced at my site.  
2010.11.21 - informed developers.  
2011.01.29 - disclosed at my site.  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/4696/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua  
  
`