Cosmoshop Cross Site Scripting

`author: l0om  
page: l0om.org  
date: 14.02.2015  
  
Cosmoshop is a simple webshop designed for the german market.  
  
There is a simple XSS flaw at the admin-login panel in probably all cosmoshop versions. The admin login can be found at  
  
http://www.shop-site.de/cgi-bin/cosmoshop/admin/index.cgi  
  
This page will show a typical login screen. The username field is filled with the value of "u_name". Since this parameter isn't filtered you can inject javascript code and trick someone to execute it.  
  
http://www.shop-site.de/cgi-bin/cosmoshop/admin/index.cgi?u_name=><script>alert("hello")</script>  
  
nothing special but better to know.  
  
Greetings and so long,  
l0om  
`