Hesk 2.5.0 XSS (CWE-79)

fix.patch

--- ./inc/common.inc.php.old    2014-04-23 16:26:38.000000000 -0300
+++ ./inc/common.inc.php        2014-04-23 16:27:59.000000000 -0300
@@ -921,7 +921,7 @@
                <td class="headersm" style="padding-left: 0px;"><?php echo $page_title; ?></td>
                <td class="headersm" style="padding-left: 0px;text-align: right">
         <script language="javascript" type="text/javascript">
-               document.write('<?php echo str_replace(array('"','<','=','>'),array('\42','\74','\75','\76'),$str . '</form>'); ?>');
+               document.write('<?php echo str_replace(array('"','<','=','>',"'"),array('\42','\74','\75','\76','\47'),$str . '</form>'); ?>');
         </script>
         <noscript>
         <?php

Hesk 2.5.0 XSS example

http://www.victim.com/ticket.php?track='),alert(document.cookie);//?&Refresh=36528&f=1