Vulnerability - cpCommerce - XSS

cpcommerce is a FOSS php-based e-commerce (shopping cart) web application. 

Exploit: Javascript placed inside a user's "Full Name:" field will not be 
stripped - it will be added to the database 'as-is' as long as it has no 
quotations in the string. When the admin goes to the clients view page, the 
javascript is executed as the rogue client's name appears. 

Gravity: The attacker can potentially fetch the admin's cookie or do a vast 
amount of other things.

Complication: This is very trivial to reproduce. Anyone with experience coding 
javascript can presently take advantage of the admin account of any unpatched 
cpcommerce shopping cart.

This is only one aspect of this cross-site scripting vulnerability. I still 
have yet to test other parts of my site which have user-inputted information 
such as product reviews and order forms.

I tested this with 1.1.0 (the latest version) - the OS is debian etch running 
apache2, php5 and mysql5. I suspect that earlier versions of cpcommerce are 
most likely also vulnerable.