CVE:CVE-2009-4047
CNNVD:CNNVD-200911-230
PHD Help Desk 1.43版本中存在多个跨站脚本攻击漏洞。远程攻击者可以借助提交到area.php的(1)PATH_INFO，到area.php的(2)pagina,(3)sentido, (4)q_registros和(5)orden参数，到solic_display.php的(6)q_registros参数，到area_list.php的(7)PATH_INFO，到area_list.php的q_registros参数，到atributo.php的(9)PATH_INFO参数，到atributo_list.php的(10)pagina,(11)q_registros和(12)orden参数，到atributo_list.php的以"sentido"开头的任意参数以及到caso_insert.php的(14)PATH_INFO，注入任意的web脚本或HTML。
solution:Upgrade p-hd phd_help_desk to a higher version than 1.43,and avoid the version 1.43