CVE:CVE-2006-0437
CNNVD:CNNVD-200602-064
phpBB 2.0.19的admin_smilies.php中存在跨站脚本攻击(XSS)漏洞。远程攻击者可以借助(1) smile_url或(2) smile_emotion参数中的Javascript事件(如"onmouseover"，可绕过对"<"和">"字符的检查)注入任意Web脚本或HTML。
solution:Upgrade phpbb_group phpbb to a higher version than 2.0.6c,2.0.6d,2.0.7,2.0.7a,2.0.8,2.0.8a,2.0.9,2.0.10,2.0.11,2.0.12,2.0.13,2.0.14,2.0.15,2.0.16,2.0.17,2.0.18,2.0.19,and avoid the version 2.0.6c,2.0.6d,2.0.7,2.0.7a,2.0.8,2.0.8a,2.0.9,2.0.10,2.0.11,2.0.12,2.0.13,2.0.14,2.0.15,2.0.16,2.0.17,2.0.18,2.0.19