CVE:CVE-2011-5214
CNNVD:CNNVD-201210-615
BrowserCRM 5.100.01和较早的版本中存在多个跨站脚本(XSS)漏洞。远程攻击者利用这些漏洞通过PATH_INFO传送到(1)index.php(2)modules/admin/admin_module_index.php或(3)modules/calendar/customise_calendar_times.php脚本；login[]参数传送到(4) index.php或(5)pub/clients.php；或framed参数传送到(6)licence/index.php或(7)licence/view.php脚本，注入任意web脚本或HTML。
solution:Upgrade browsercrm browsercrm to a higher version than 5.100.01,4.604.01,4.605.00,4.607.00,4.610.00,4.611.01,4.612.00,4.614.00,4.615.10,4.615.11,4.616.00,4.617.00,4.619.00,4.620.01,4.622.00,4.624.00,4.624.01,4.624.50,4.624.60,4.624.70,4.624.80,4.624.90,4.691.01,4.999.20,5.000.00,5.000.01,5.001.00,5.002.00,5.100.00,and avoid the version (,5.100.01],4.604.01,4.605.00,4.607.00,4.610.00,4.611.01,4.612.00,4.614.00,4.615.10,4.615.11,4.616.00,4.617.00,4.619.00,4.620.01,4.622.00,4.624.00,4.624.01,4.624.50,4.624.60,4.624.70,4.624.80,4.624.90,4.691.01,4.999.20,5.000.00,5.000.01,5.001.00,5.002.00,5.100.00