There is no user input sanitation for some parameters in trade.php in CJOverkill version 4.0.3, allowing for cross site scripting attacks to take place.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/34630/cjoverkill403.txt
Source: https://packetstormsecurity.com/files/34630/cjoverkill403.txt.html