The vulnerable code is found in the template file of the manufacturer block(modules\blockmanufacturer\blockmanufacturer.tpl), where in the following: <form action="{$smarty.server.SCRIPT_NAME}" method="get"> it is printed the current path of the script without checking if it contains any malicious c...