Nice HTML injection.
Please telll me they do not try to build a system where any payment in involved.
/panic

An e-content-commerce tool for selling the books is "stage IV" of the VTO plan.

Update: They fixed the HTML injection vulnerability.

The MVB takes back some of their statements from an earlier press release, now saying that Mr. Thomas Brüggemann was not exempted from his job due to this project, but that he left earlier already for other reasons, thanking him for his successful work. They go on to say that the security hole – which they don't fully admit was a security hole by putting it in quotations throughout the text – happened because someone didn't finish configurating "certain parameters" (sheesh, whatever), and that Thomas wasn't responsible for that. (They don't mention who was responsible, actually.) MVB's new release slightly implies that the problem was in any way connected to Firefox, which is not true.

New press release (German):
http://www.boersenblatt.net/138823/template/b3_tpl_home_detail/