CVE:CVE-2007-4412
CNNVD:CNNVD-200708-288
Headstart Solutions DeskPRO 3.0.2版本中存在多个跨站脚本攻击漏洞。远程验证用户，可以借助(1) techs.php, (2) ticket_category.php, (3) ticket_priority.php, (4) ticket_workflow.php, (5) ticket_escalate.php, (6) fields_ticket.php, (7) ticket_rules_web.php, (8) ticket_displayfields.php, (9) ticket_rules_mail.php, (10) fields_user.php, (11) fields_faq.php, and (12) (a) admincp/ 和 (b)  "User side"一个可能目录上的user_help.php的未明参数，注入任意web脚本或HTML。
solution:Upgrade headstart_solutions deskpro to a higher version than 3.0.2,and avoid the version 3.0.2