Cross-site Scripting (XSS) Vulnerabilities in synType CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in synType CMS which could be exploited to perform cross-site scripting and script insertion attacks.

1) Cross-site scripting (XSS) vulnerability in synType CMS
The vulnerability exists due to input sanitation error in the search filed. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
Enter the following text into search filed
search"><script>alert(document.cookie)</script>

2) Script insertion vulnerability in synType CMS
Input passed to the "cmnt_body" parameter is not properly sanitized. A remote attacker can insert arbitrary HTML and script code, which will be executed in user`s browser in context of the vulnerable website when user views the malicious data.
Exploitation example:
Enter the following text into comment filed
comment bit"><script>alert(document.cookie)</script>