CVE:CVE-2010-3690
CNNVD:CNNVD-201010-070
Jasig phpCAS是英国Jasig公司的一个ITS集中式认证服务（Central Authentication Service）的PHP客户端开发包。
phpCAS 1.1.3之前的版本中存在多个跨站脚本攻击漏洞。远程攻击者可以借助(1)client.php文件中回调函数中特制的Proxy Granting Ticket IOU (PGTiou)参数,(2)涉及与getCallbackURL调用函数相关的向量,或者(3)涉及与getURL调用函数相关的向量注入任意web脚本或者HTML。
solution:Upgrade apereo phpcas to a higher version than 1.1.2,0.2,0.3,0.3.1,0.3.2,0.4,0.4.1,0.4.8,0.4.9,0.4.10,0.4.11,0.4.12,0.4.13,0.4.14,0.4.15,0.4.16,0.4.17,0.4.18,0.4.19,0.4.20,0.4.21,0.4.22,0.4.23,0.5.0,0.5.1,0.6.0,1.0.0,1.0.1,1.1.0,1.1.1,and avoid the version (,1.1.2],0.2,0.3,0.3.1,0.3.2,0.4,0.4.1,0.4.8,0.4.9,0.4.10,0.4.11,0.4.12,0.4.13,0.4.14,0.4.15,0.4.16,0.4.17,0.4.18,0.4.19,0.4.20,0.4.21,0.4.22,0.4.23,0.5.0,0.5.1,0.6.0,1.0.0,1.0.1,1.1.0,1.1.1