CVE:CVE-2008-5569
CNNVD:CNNVD-200812-254
PHPepperShop是一款基于PHP实现的电子商店程序。
PHPepperShop 1.4中存在多个跨站脚本攻击漏洞。远程攻击者可以借助 shop/Admin/中的对(1) index.php或(2) shop/kontakt.php,或(3) shop_kunden_mgmt.php或(4) SHOP_KONFIGURATION.php的PATH_INFO，注入任意web脚本或HTML。
solution:Upgrade phpeppershop phpeppershop to a higher version than 1.4,and avoid the version 1.4