Chamilo LCMS Connect 4.1 Cross Site Scripting

[Aerosol]

Hi Team,

#Affected Vendor: http://lcms.chamilo.org/
#Date: 27/03/2015
#Discovered by: Joel Vadodil Varghese
#Type of vulnerability: Persistent XSS
#Tested on: Windows 7
#Product: LCMS Connect
#Version: 4.1
#Description: Chamilo is an open-source (under GNU/GPL licensing)
e-learning and content management system, aimed at improving access to
education and knowledge globally.
Chamilo LCMS is a completely new software platform for e-learning and
collaboration. Chamilo LCMS connect is vulnerable to stored xss
vulnerability. The parameter "site_name" is the vulnerable parameter which
will lead to its compromise.
#Proof of Concept (PoC):
------------------------
site_name=<img src="" onerror="alert('XSS')"/>

-- 
Regards,

*Joel V*

Source