Some vulnerabilities have been discovered CMME, which can be exploited by malicious users to compromise a vulnerable system and disclose sensitive information and by malicious people to conduct cross-site scripting attacks.

1) The vulnerabilities exist in the bundled version of Xinha.

For more information:
SA40669
SA39782

2) Input passed via the "page" parameter to admin.php is not properly sanitised admin_actions.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) Input passed via the "name" parameter to admin.php (when "action" is set to "templates", "subaction" is set to "menu", and "env" is set to "data") is not properly verified before being used to read files. This can be exploited to read arbitrary files from local resources via directory traversal sequences and URL-encoded NULL bytes.

The vulnerabilities are confirmed in version 1.22. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised and verified. Restrict access to the xinha/plugins/ExtendedFileManager/demo_images and xinha/plugins/ImageManager/demo_images folder (e.g. via .htaccess).

Provided and/or discovered by
2, 3) Russ McRee via Secunia.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Russ McRee:
http://holisticinfosec.org/content/view/170/45/

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers