SiliSoftware phpThumb() 1.7.11 Cross Site Scripting

`  
phpThumb() v1.7.11 (dir & title) Cross-Site Scripting Vulnerability  
  
  
Vendor: SiliSoftware  
Product web page: http://www.silisoftware.com  
Affected version: 1.7.11-201108081537  
  
Summary: phpThumb() uses the GD library to create thumbnails from  
images (JPEG, PNG, GIF, BMP, etc) on the fly. The output size is  
configurable (can be larger or smaller than the source), and the  
source may be the entire image or only a portion of the original  
image.  
  
Desc: phpThumb is prone to a cross-site scripting vulnerability.  
This issue is due to a failure in the application to properly  
sanitize user-supplied input to the 'dir' and the 'title' parameter  
of the 'phpThumb.demo.random.php' and 'phpThumb.demo.showpic.php'  
scripts. Attackers can exploit this weakness to execute arbitrary  
HTML and script code in a user's browser session.  
  
Tested on: Microsoft Windows XP Professional SP3 (EN)  
Apache 2.2.21  
PHP 5.3.8  
MySQL 5.5.20  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2012-5088  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5088.php  
  
  
  
15.05.2012  
  
--  
  
GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.random.php?dir="><script>alert(document.cookie);</script> HTTP/1.1  
GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.showpic.php?title="><script>alert(document.cookie);</script> HTTP/1.1  
`