PhpMyFAQ 2.6.x index. php cross-site scripting vulnerability and repair

Affected Versions:
PhpMyFAQ 2.6.x

Vulnerability description:

PhpMyFAQ is a multi-language, database-based FAQ System.

PhpMyFAQ does not properly filter the request parameters submitted to the index. php page and returns them to the user. Remote attackers can inject JavaScript code to the page output by submitting malicious URL requests, resulting in Domain Cookie Theft.

<* Reference
Http://www.phpmyfaq.de/advisory_2010-09-28.php
Http://secunia.com/advisories/41625/
Http://marc.info /? L = bugtraq & m = 128578428215399 & w = 2
*>
Test method:
 
The Program (method) provided on this site may be offensive and only used for security research and teaching. You are at your own risk!
Http://www.example.com/index.php/&quot;&gt;&lt;script&gt;alert (& quot; XSS & quot;) & lt;/script & gt;

Vendor patch:

PhpMyFAQ
--------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.phpmyfaq.de/