Proof of Concept:
=================
The vulnerability can be exploited by remote attackers with service user account. Exploitation requires low user, 
moderator or admin inter action. For demonstration or reproduce ...


<div class="label">
<span id="displayPhoneLabel">Eingegebene Nummer:</span>
</div>
<div class="entry">
<span id="displayPhoneLabel">>"<[MALICIOUS PERSISTENT SCRIPT CODE INJECT]"></span>
</div>
</div>
<input id='countryHidden' type='hidden' value='250' />
<div class='row'>
<div class='label'>
<span id='countryRegionLabel'>Land/Region:</span>
</div>
<div class='entry'>


... or


<tr xmlns="http://www.w3.org/1999/xhtml">

<td><img alt="" src="/PartnerProgram/WebResource.axd?d=-Tv3sV_xp32BwONeW9hUQo0fFWY-RDp2Doe-qePp16cPAoXfoy546q9RX-1OFMrOxzhCO3oAeAxwhGn1p4eUC6CYSYmmUfyVtrYNLpkxj_3KbQmv0&t=634607579700584141"/>&#8203;&#8203;&#8203;&#8203;&#8203;</td><td style="white-space: nowrap;" 
onmouseout="TreeView_UnhoverNode(this)" onmouseover="TreeView_HoverNode(ctl00_ctl00_ContentMain_ContentMain_location
Hierarchy_locationHierarchyTreeView_TreeView_Data, this)" class="ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_
locationHierarchyTreeView_TreeView_6 ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_locationHierarchyTreeView_TreeView_2 ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_locationHierarchyTreeView_TreeView_4"><a id="ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_locationHierarchyTreeView_TreeViewt0" onclick="TreeView_SelectNode(ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_locationHierarchyTreeView_TreeView_Data, this,'ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_locationHierarchyTreeView_TreeViewt0');TreeView_FindStyleManager
ByTreeNode(this.id).ChangeStyle(this.id);HierarchyControl_Find('ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_
locationHierarchyTreeView').Select(this.id); SetSelectedValue('ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_
selectedValue', this.id); EnableSelectButton('ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_selectButton');" 
href="javascript:void(0)" class="ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_locationHierarchyTreeView_TreeView_5 ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_locationHierarchyTreeView_TreeView_0 ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_locationHierarchyTreeView_TreeView_1 ctl00_ctl00_ContentMain_ContentMain_locationHierarchy_locationHierarchyTreeView_TreeView_3">[MALICIOUS PERSISTENT SCRIPT CODE INJECT] (HQ) 
(Kassel)</a>&#8203;&#8203;&#8203;&#8203;&#8203;</td>
	</tr>