Fatt Free CRM Cross Site Scripting

`Hello Guys this is Sam , CEO and Chief Security Architect Provensec LLC .  
Please take note of the following submission.  
  
# Affected software: Fatt Free CRM - URL: http://www.fatfreecrm.com/  
# Discovered by: Provensec  
# Website: http://www.provensec.com  
# Type of vulnerability: XSS Stored  
#  
# Fat Free CRM is an open source  
Ruby on Rails-based customer relationship management platform. Out of the  
box it features group collaboration, campaign and lead management, contact  
lists, and opportunity tracking.  
#  
# Description: Fat Free CRM is prone to a Persistent Cross Site Scripting  
attack that allows a malicious user to inject HTML or scripts that can  
access any cookies, session tokens, or other  
sensitive information retained by your browser and used with that site.  
# Proof of concept:  
1> Go to http://demo.fatfreecrm.com  
2> Create a account and go to edit profile.  
3> Fill the first name with a javascript payload eg:<script>XSS by  
Provensec</script>  
4> save it and reload the page. the javascript payload gets executed  
on the browser  
`