rgod has reported some vulnerabilities in DEV web management system, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.

1) Input passed to the "cat" parameter in "index.php" and "getfile.php", and the "target" parameter in "download_now.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Examples:
http://[host]/index.php?session=0&action=openforum&cat=[code]
http://[host]/getfile.php?cat=[code]
http://[host]/download_now.php?target=[code]

2) Input passed to the "language" array parameter in "add.php" isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Examples:
http://[host]/add.php?language[ENTER_ARTICLE_TITLE]=[code]
http://[host]/add.php?language[SPECIFY_ZONE]=[code]
http://[host]/add.php?language[ENTER_ARTICLE_HEADER]=[code]
http://[host]/add.php?language[ENTER_ARTICLE_BODY]=[code]

The vulnerabilities have been reported in version 1.5 and prior. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by
rgod

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://rgod.altervista.org/dev_15_sql_xpl.html

Deep Links
Links available to Secunia VIM customers