CVE:CVE-2010-2158
CNNVD:CNNVD-201006-062
Drupal是很著名的开源内容管理平台，仿照了blog程序模式，但比普通的blog更灵活，可以做各种网站的内容管理平台。
Drupal的Storm模块存在多个跨站脚本攻击(XSS)漏洞，拥有某些模块权限的远程认证用户可利用index.php stromperson功能的(1)全称，(2)电话，或(3)im参数注入任意web脚本或HTML。
solution:Upgrade speedtech storm to a higher version than 5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.7,5.x-1.8,5.x-1.9,5.x-1.10,5.x-1.11,5.x-1.12,5.x-1.13,5.x-1.14,5.x-1.x:dev,6.x-1.0,6.x-1.1,6.x-1.2,6.x-1.3,6.x-1.4,6.x-1.5,6.x-1.6,6.x-1.7,6.x-1.8,6.x-1.9,6.x-1.10,6.x-1.11,6.x-1.12,6.x-1.13,6.x-1.14,6.x-1.15,6.x-1.16,6.x-1.17,6.x-1.18,6.x-1.19,6.x-1.20,6.x-1.21,6.x-1.22,6.x-1.23,6.x-1.24,6.x-1.25,6.x-1.26,6.x-1.27,6.x-1.28,6.x-1.29,6.x-1.30,6.x-1.31,6.x-1.32,6.x-1.x:dev,and avoid the version 5.x-1.1,5.x-1.2,5.x-1.3,5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.7,5.x-1.8,5.x-1.9,5.x-1.10,5.x-1.11,5.x-1.12,5.x-1.13,5.x-1.14,5.x-1.x:dev,6.x-1.0,6.x-1.1,6.x-1.2,6.x-1.3,6.x-1.4,6.x-1.5,6.x-1.6,6.x-1.7,6.x-1.8,6.x-1.9,6.x-1.10,6.x-1.11,6.x-1.12,6.x-1.13,6.x-1.14,6.x-1.15,6.x-1.16,6.x-1.17,6.x-1.18,6.x-1.19,6.x-1.20,6.x-1.21,6.x-1.22,6.x-1.23,6.x-1.24,6.x-1.25,6.x-1.26,6.x-1.27,6.x-1.28,6.x-1.29,6.x-1.30,6.x-1.31,6.x-1.32,6.x-1.x:dev