CVE:CVE-2008-4537
CNNVD:CNNVD-200810-175
EC-CUBE Ver1, Ver1 Beta, Ver2, Ver2 Beta(RC), Community Edition, 以及Community Edition Nightly-Build r17336 及其早期版本中存在跨站脚本攻击漏洞。远程攻击者可以通过未明向量来执行任意web脚本或HTML。
solution:Upgrade ec-cube ec-cube to a higher version than *:unknown,2.1.2a,2.3.0,1.0,1.4.7,1.5.0:b2,and avoid the version *:unknown,(,2.1.2a],(,2.3.0],1.0,1.4.7,1.5.0:b2