CVE:CVE-2007-6608
CNNVD:CNNVD-200712-376
OpenBiblio中的多个跨站脚本攻击漏洞使远程攻击者可以借助(1) LAST 和 (2) 对admin/staff_del_confirm.php的FIRST参数, (3) 对admin/theme_del_confirm.php的名称参数, 或者(4)对admin/theme_preview.php的themeName参数，注入任意web脚本或HTML。
solution:Upgrade openbiblio openbiblio to a higher version than 0.2,0.2.1,0.3,0.5.1,0.5.2,0.5.2_pre4,and avoid the version 0.2,0.2.1,0.3,0.5.1,0.5.2,0.5.2_pre4