osCommerce 2.2 - 'manufacturers_id' Cross-Site Scripting

Author: JeiAr
type: webapps
platform: php
port: 
date_added: 2003-12-22
date_updated: 2012-12-17
verified: 1
codes: OSVDB-7368
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/9277/info

A vulnerability has been reported to exist in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in certain URI parameters passed to the default.php script. This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the site.

http://www.example.com/default.php?manufacturers_id="><iframe src=http://www.gulftech.org>