CVE:CVE-2008-0605
CNNVD:CNNVD-200802-072
AstroSoft HelpDesk 1.95.228之前的版本中的多个跨站脚本攻击漏洞允许远程攻击者借助(1)到operator/article/article_search_results.asp的txtSearch参数和(2)到operator/article/article_attachment.asp的Attach_Id参数注入任意的web脚本或HTML。注意：对于第二种攻击方式而言，XSS发生在一个被迫的SQL错误信息中。
solution:Upgrade astrosoft astrosoft_helpdesk to a higher version than 1.95.227,and avoid the version (,1.95.227]