CVE:CVE-2010-2041
CNNVD:CNNVD-201005-347
PHP-Calendar是一套基于Web的日历事务系统。该系统支持跟踪日程信息。
PHP-Calendar的脚本index.php存在多个跨站脚本攻击漏洞。远程攻击者可以借助参数(1)description和(2)lastaction注入任意的web脚本和HTML。
solution:Upgrade php-calendar php-calendar to a higher version than *:beta6,0.1,0.2,0.3,0.4,0.5,0.6,0.7,0.8,0.9,0.9.1,0.10,1.1,2.0:beta1,2.0:beta2,2.0:beta3,2.0:beta4,2.0:beta5,and avoid the version *:beta6,0.1,0.2,0.3,0.4,0.5,0.6,0.7,0.8,0.9,0.9.1,0.10,1.1,2.0:beta1,2.0:beta2,2.0:beta3,2.0:beta4,2.0:beta5