Some vulnerabilities have been discovered in AdaptCMS Lite, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks and compromise a vulnerable system.

1) Input passed to the "sitepath" parameter in plugins/rss_importer_functions.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local and remote resources.

Successful exploitation of this vulnerability requires that "register_globals" is enabled.

2) Input passed to the "url" parameter in index.php (when "view" is set to "redirect") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

3) Input passed to the "acuparam" parameter in index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

4) Input passed via the URI to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

5) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. change the administrative password or add an administrative user by tricking an administrative user into visiting a malicious web site.

NOTE: Vulnerabilities #3 and #4 are confirmed using Internet Explorer.

These vulnerabilities are confirmed in versions 1.4 Lite and 1.5 Lite. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly verified and sanitised. Do not browse untrusted websites or follow untrusted links while logged in to the application.

Provided and/or discovered by
1 - 4) RoMaNcYxHaCkEr
5) ItSecTeam

Changelog
Further details available to Secunia VIM customers

Original Advisory
1 - 4) http://milw0rm.com/exploits/8016

Deep Links
Links available to Secunia VIM customers