CVE:CVE-2011-4806
CNNVD:CNNVD-201112-218
phpAlbum 是一个开源的php脚本。
phpAlbum 0.4.1.16及之前版本的main.php中存在多个跨站脚本漏洞。远程攻击者可借助(1)var1和(2)keyword参数注入任意web脚本或者HTML。
solution:Upgrade phpalbum phpalbum to a higher version than 0.4.1.16,0.2.1,0.2.2,0.2.3,0.2.4,0.3.0,0.3.1,0.3.1:fix01,0.3.1:fix02,0.3.2,0.4.1-14,0.4.1-14:fix01,0.4.1-14:fix02,0.4.1-14:fix03,0.4.1-14:fix05,0.4.1-14:fix06,0.4.1.14,0.4.1.15,and avoid the version (,0.4.1.16],0.2.1,0.2.2,0.2.3,0.2.4,0.3.0,0.3.1,0.3.1:fix01,0.3.1:fix02,0.3.2,0.4.1-14,0.4.1-14:fix01,0.4.1-14:fix02,0.4.1-14:fix03,0.4.1-14:fix05,0.4.1-14:fix06,0.4.1.14,0.4.1.15