CVE:CVE-2007-2337
CNNVD:CNNVD-200704-570
Exponent CMS中存在多个跨站脚本攻击漏洞。远程攻击者可以借助下列脚本及参数注入任意的web脚本或HTML:
(1)external/magpierss/scripts/目录中脚本(a)magpie_debug.php和(b)magpie_simple.php的url参数；
(2)external/magpierss/scripts/目录中脚本(c)magpie_slashbox.php的rss_url参数;
(3)(d)模块weblogmodule(又称Weblog Comments)模块的body参数
solution:Upgrade oicgroup exponent_cms to a higher version than *:alpha,0.94,0.95,0.96.1,0.96.3,0.96.4,0.96.5:rc1,and avoid the version *:alpha,0.94,0.95,0.96.1,0.96.3,0.96.4,0.96.5:rc1