Cross-site Scripting Vulnerability in ecoCMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in ecoCMS which could be exploited to perform cross-site scripting (XSS) attacks.

1. Cross-site scripting vulnerability in ecoCMS: CVE-2010-5046
   Input validation error was found in the “p” parameter in /admin.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and scripting code in user`s browser in context of the vulnerable website.

Exploitation example:

http://example.com/admin.php?p=1"><script>alert(document.cookie) %3C/script%3E