CMSimple 3.3 Cross Site Scripting

`  
CMSimple.COM   
vendor: www.cmsimple.com  
Version: CMSimple 3.3  
Author: Karthik R (3psil0nLambDa)  
Email: [email protected]  
My blog: www.epsilonlambda.co.cc  
Google dork: Powered by CMSimple  
  
------------------------------------------------------------------------------------------------------------------------------------------------------------  
  
Description about the CMS  
  
CMSimple is one of the smallest, smartest and most simple Content Management Systems under the GPL or AGPL licence.  
  
CMSimple is distributed under the GPL3 and AGPL3 licence as Open Source to use, modify and distribute under the given licence.  
  
------------------------------------------------------------------------------------------------------------------------------------------------------------  
* Persistent XSS vulnerability  
After login to the demo with password=test, choose edit mode, and then, choose html button in the toolbox, and write the below code, after clearing off the existing code there. A pop up comes showing persistent xss vulnerability in the full version.  
  
Exploit: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>  
  
PS: In the demo, as they have mentioned in the site, the write option to files have been disabled, unlike fullversion. So, here we can only see the way the script behaves in the layout which shows xss vulnerability, which shall be persistent in the full version once the write permissions are allowed.  
  
  
------------------------------------------------------------------------------------------------------------------------------------------------------------  
Thanks to side-effects for his valuable guidance and greets to taashu for her love and support.  
`