Eventum 2.3.1 stored XSS

# Exploit Title: Eventum 2.3.1 stored XSS
# Date: 19-2-2011
# Author: Saif El-Sherei
# Software Link: [download link if available]
# Version: Eventum 2.3.1
# Tested on: FF 3.0.15, IE 8

Info:

Eventum is a user-friendly and flexible issue tracking system that can be used by a support department to track incoming technical support requests, or by a software development team to quickly organize tasks and bugs.

Details:

The "Full-Name" variable is not properly santized before displayed in any page. where an authorized user can perform this attack on other users who has access to the system, by changing his own "full-name" in the prefrences section.

POC:

<script>alert9'w00t');</script>

contact:
please contact me @ my email "<email address hidden>" for confirmation.

Regards,

Saif El-Sherei
OSCP