CVE:CVE-2010-2463
CNNVD:CNNVD-201006-425
Jamroom 4.1.9之前版本的forum.php存在跨站脚本攻击漏洞。远程攻击者可以借助modify功能的post_id参数执行任意的web脚本和HTML。
solution:Upgrade jamroom jamroom to a higher version than 4.1.8,1.0,1.0:b1,1.0:b2,1.0:b3,1.0:b4,1.0:b5,2.0.9,2.0.9:a,2.6.10,2.6.11,2.6.12,2.60,2.60:rc2,2.60:rc3,2.61,2.62,2.63,2.64,2.65,2.66,2.67,2.68,2.69,3.0,3.0:b1,3.0:b2,3.0:b3,3.0:b4,3.0:b5,3.0:b6,3.0:b7,3.0:b8,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6,3.0.7,3.0.8,3.0.9,3.0.10,3.0.11,3.0.12,3.0.13,3.0.14,3.0.15,3.0.16,3.0.17,3.0.18,3.0.19,3.0.20,3.0.21,3.0.22,3.0.23,3.0.24,3.0.25,3.0.26,3.0.27,3.0.28,3.0.29,3.0.30,3.1.0,3.1.0:b1,3.1.0:b2,3.1.0:b3,3.1.1,3.1.2,3.1.3,3.1.4,3.1.5,3.2.0,3.2.1,3.2.2,3.2.3,3.2.4,3.2.5,3.2.6,3.3.0,3.3.1,3.3.2,3.3.3,3.3.4,3.3.5,3.3.6,3.3.7,3.3.8,3.4.0,4.0.2,4.0.3,4.0.4,4.0.5,4.0.6,4.0.7,4.0.8,4.0.9,4.0.10,4.0.11,4.0.12,4.0.13,4.0.14,4.1.0,4.1.1,4.1.2,4.1.3,4.1.4,4.1.5,4.1.6,4.1.7,and avoid the version (,4.1.8],1.0,1.0:b1,1.0:b2,1.0:b3,1.0:b4,1.0:b5,2.0.9,2.0.9:a,2.6.10,2.6.11,2.6.12,2.60,2.60:rc2,2.60:rc3,2.61,2.62,2.63,2.64,2.65,2.66,2.67,2.68,2.69,3.0,3.0:b1,3.0:b2,3.0:b3,3.0:b4,3.0:b5,3.0:b6,3.0:b7,3.0:b8,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6,3.0.7,3.0.8,3.0.9,3.0.10,3.0.11,3.0.12,3.0.13,3.0.14,3.0.15,3.0.16,3.0.17,3.0.18,3.0.19,3.0.20,3.0.21,3.0.22,3.0.23,3.0.24,3.0.25,3.0.26,3.0.27,3.0.28,3.0.29,3.0.30,3.1.0,3.1.0:b1,3.1.0:b2,3.1.0:b3,3.1.1,3.1.2,3.1.3,3.1.4,3.1.5,3.2.0,3.2.1,3.2.2,3.2.3,3.2.4,3.2.5,3.2.6,3.3.0,3.3.1,3.3.2,3.3.3,3.3.4,3.3.5,3.3.6,3.3.7,3.3.8,3.4.0,4.0.2,4.0.3,4.0.4,4.0.5,4.0.6,4.0.7,4.0.8,4.0.9,4.0.10,4.0.11,4.0.12,4.0.13,4.0.14,4.1.0,4.1.1,4.1.2,4.1.3,4.1.4,4.1.5,4.1.6,4.1.7