CVE:CVE-2007-5629
CNNVD:CNNVD-200710-452
ShoppingTree CandyPress Store 4.1版本的admin/logon.asp中存在跨站脚本攻击漏洞。远程攻击者可以借助msg参数，注入任意web脚本或HTML。
solution:Upgrade candypress candypress_store to a higher version than 4.1,and avoid the version 4.1