osCommerce 2.2 - 'manufacturers_id' Cross-Site Scripting

Author: JeiAr
type: webapps
platform: php
port: 
date_added: 2003-12-22 
date_updated: 2012-12-17 
verified: 1 
codes: OSVDB-7368 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/9277/info

A vulnerability has been reported to exist in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in certain URI parameters passed to the default.php script. This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the site.

http://www.example.com/default.php?manufacturers_id="><iframe src=http://www.gulftech.org>