CVE:CVE-2009-4083
CNNVD:CNNVD-200911-276
e107是用php编写的内容管理系统。 
e107的以下模块没有充分的过滤用户所提交的变量：
- submitnews.php
- usersettings.php.
- e107_admin/newpost.php.
- e107_admin/banlist.php.
- e107_admin/banner.php.
- e107_admin/cpage.php
- e107_admin/download.php.
- e107_admin/users_extended.php.
- e107_admin/frontpage.php.
- e107_admin/links.php.
- e107_admin/mailout.php.
远程攻击者可以通过提交恶意请求执行跨站脚本攻击。当用户登录到e107并点击这些链接时，就会在浏览器会话中执行注入的代码。
solution:Upgrade e107 e107 to a higher version than 0.7.16,0.6_10,0.6_11,0.6_12,0.6_13,0.6_14,0.6_15,0.6_15a,0.7,0.7.1,0.7.2,0.7.3,0.7.4,0.7.5,0.7.6,0.7.7,0.7.8,0.7.9,0.7.10,0.7.11,0.7.12,0.7.13,0.7.14,0.7.15,0.545,0.547_beta,0.548_beta,0.549_beta,0.551_beta,0.552_beta,0.553_beta,0.554,0.554_beta,0.555_beta,0.600,0.601,0.602,0.603,0.604,0.605,0.606,0.607,0.608,0.609,0.610,0.611,0.612,0.613,0.614,0.615,0.615a,0.616,0.617,0.6171,0.6172,0.6173,0.6174,0.6175,and avoid the version (,0.7.16],0.6_10,0.6_11,0.6_12,0.6_13,0.6_14,0.6_15,0.6_15a,0.7,0.7.1,0.7.2,0.7.3,0.7.4,0.7.5,0.7.6,0.7.7,0.7.8,0.7.9,0.7.10,0.7.11,0.7.12,0.7.13,0.7.14,0.7.15,0.545,0.547_beta,0.548_beta,0.549_beta,0.551_beta,0.552_beta,0.553_beta,0.554,0.554_beta,0.555_beta,0.600,0.601,0.602,0.603,0.604,0.605,0.606,0.607,0.608,0.609,0.610,0.611,0.612,0.613,0.614,0.615,0.615a,0.616,0.617,0.6171,0.6172,0.6173,0.6174,0.6175