web@all CMS 2.0 Multiple Remote XSS Vulnerabilities

Title: web@all CMS 2.0 Multiple Remote XSS Vulnerabilities
Advisory ID: ZSL-2012-5098
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 23.08.2012
Summary
web@all is a PHP content management system (CMS). If you know about it,you nearly can use it to do anything.
Description
web@all CMS suffers from multiple stored and reflected cross-site scripting vulnerabilities. The issues are triggered when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Vendor
web@all - http://www.webatall.org
Affected Version
2.0
Tested On
Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a
Vendor Status
N/A
PoC
webatall_xss.txt
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] http://packetstormsecurity.org/files/115814
[2] http://www.securityfocus.com/bid/55176
[3] http://secunia.com/advisories/49922/
[4] http://1337day.com/exploits/19245
[5] http://xforce.iss.net/xforce/xfdb/77934
[6] http://xforce.iss.net/xforce/xfdb/77935
[7] http://www.exploit-db.com/exploits/20857/
[8] http://www.osvdb.org/show/osvdb/85962
Changelog
[23.08.2012] - Initial release
[24.08.2012] - Added reference [2], [3] and [4]
[25.08.2012] - Added reference [5] and [6]
[27.08.2012] - Added reference [7]
[11.11.2012] - Added reference [8]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk