CVE:CVE-2007-2300
CNNVD:CNNVD-200704-519
Endy Kristanto Surat kabar/News Management Online(又称phpwebnews)中存在多个跨站脚本攻击漏洞。远程攻击者可以借助提交到(1)iklan.php,(2)index.php或(3)bukutamu.php的m_txt参数，注入任意的web脚本或HTML。
solution:Upgrade surat_kabar phpwebnews to a higher version than 0.1,0.2,and avoid the version 0.1,0.2