CVE:CVE-2009-3789
CNNVD:CNNVD-200910-387
OpenDocMan 1.2.5版本中存在多个跨站脚本攻击漏洞。远程攻击者可以借助对(1)add.php,(2)toBePublished.php,(3)index.php,和(4)admin.php的last_message参数; 对(5)category.php,(6)department.php,(7)profile.php,(8)rejects.php,(9)search.php,(10) oBePublished.php,(11)user.php,和(12)view_file.php的默认URI的PATH_INFO; 以及(13)对user.php的一个修改用户操作中的caller参数，注入任意web脚本或HTML。
solution:Upgrade opendocman opendocman to a higher version than 1.2.5,and avoid the version 1.2.5