CVE:CVE-2006-3009
CNNVD:CNNVD-200606-287
Open Business Management (OBM) 1.0.3 pl1存在多个跨站脚本攻击(XSS)漏洞，远程攻击者可通过传给诸如(a)publication/publication_index.php，(b)group/group_index.php，(c)user/user_index.php，(d)list/list_index.php和(e)company/company_index.php等文件的(1) tf_lang，(2)tf_name，(3)tf_user，(4)tf_lastname，(5)tf_contact，(6)tf_datebefore和(7)tf_dateafter参数，来注人任意HTML或Web脚本。
solution:Upgrade aliacom open_business_management to a higher version than 1.0.3_pl1,and avoid the version 1.0.3_pl1