Multiple Vulnerabilities in boastMachine

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in boastMachine which could be exploited to perform cross-site scripting attacks and execute arbitrary SQL commands in application`s database.

1) Cross-site scripting (XSS) vulnerability in boastMachine
The vulnerability exists due to input sanitation error in the "key" parameter in index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/?action=search&title=item&blog=1&key=%22%3E%3Cscript%3Ealert%28d ocument.cookie%29%3C/script%3E

2) SQL injection vulnerability in boastMachine: CVE-2008-0422
The vulnerability exists due to input sanitation error in the "id" parameter in mail.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
This vulnerability was independently discovered by Virangar Security Team (http://seclists.org/bugtraq/2008/Jan/301).
Exploitation example:
http://host/mail.php?blog=1&id=-1%27+union+select+1,2,user%28%29,4+--+