CVE:CVE-2005-3397
CNNVD:CNNVD-200511-023
Comersus BackOffice是基于ASP实现的开放源代码的网络购物系统。
Comersus BackOffice中的跨站脚本攻击(XSS)漏洞，可让远程攻击者通过comersus_backoffice_supportError.asp的错误参数注入任意Web脚本或HTML。注意：CVE-2005-2191第2项已涵盖了comersus_backoffice_message.asp/消息矢量。
solution:Upgrade comersus_open_technologies comersus_backoffice_lite to a higher version than *,4.2,4.5,4.10,4.11,4.30,4.32,5.0,5.0.9,6.0,6.0.1,and avoid the version 4.2,4.5,4.10,4.11,4.30,4.32,5.0,5.0.9,6.0,6.0.1; Upgrade comersus_open_technologies comersus_backoffice_plus to a higher version than *,4.2,4.5,4.10,4.11,4.30,4.32,5.0,5.0.9,6.0,6.0.1,and avoid the version 4.2,4.5,4.10,4.11,4.30,4.32,5.0,5.0.9,6.0,6.0.1