Some vulnerabilities have been discovered in TomatoCMS, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct SQL injection attacks.

1) Input passed via the "content" parameter to index.php/admin/poll/add is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires "Create new poll" permissions.

2) Input passed via the "meta" parameter to index.php/admin/category/add is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires "Create new category" permissions.

3) Input passed via the "keyword" parameter to index.php/admin/tag/add is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires "Create new tag" permissions.

4) Input passed via the "q" parameter to index.php/news/search is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

5) Input passed via the "title", "subTitle", and "author" parameters to index.php/admin/news/article/add is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires "Add new article" permissions.

The vulnerabilities are confirmed in version 2.0.4. Prior versions may also be affected.

Solution
Update to version 2.0.5.

Provided and/or discovered by
1 - 3) Reported by Russ McRee, HolisticInfoSec via Secunia
4, 5) Secunia Research

Changelog
Further details available to Secunia VIM customers

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2010-56/
http://secunia.com/secunia_research/2010-59/

HolisticInfoSec:
http://holisticinfosec.org/content/view/141/45/

Deep Links
Links available to Secunia VIM customers