CVE:CVE-2008-0124
CNNVD:CNNVD-200802-491
Serendipity (S9Y)存在跨站脚本漏洞。远程认证用户可以借助(1)个人设置中的"实名"域, 它会给读者显示文章；(2)一个文件上传，比如.htm,.html,或者.js 文件注入任意的Web脚本或HTML。
solution:Upgrade s9y serendipity to a higher version than 0.3,0.4,0.5,0.5_pl1,0.6,0.6_pl1,0.6_pl2,0.6_pl3,0.6_rc1,0.6_rc2,0.7,0.7.1,0.7_beta1,0.7_beta2,0.7_beta3,0.7_beta4,0.7_rc1,0.8,0.8.1,0.8.2,0.8_beta_6_snapshot,0.8_beta5,0.8_beta6,0.9.1,1.0.3,1.0.4,1.0_beta2,1.0_beta3,1.1.1,1.1.3,1.1.4,1.2,1.2.1,1.2__beta5,and avoid the version 0.3,0.4,0.5,0.5_pl1,0.6,0.6_pl1,0.6_pl2,0.6_pl3,0.6_rc1,0.6_rc2,0.7,0.7.1,0.7_beta1,0.7_beta2,0.7_beta3,0.7_beta4,0.7_rc1,0.8,0.8.1,0.8.2,0.8_beta_6_snapshot,0.8_beta5,0.8_beta6,0.9.1,1.0.3,1.0.4,1.0_beta2,1.0_beta3,1.1.1,1.1.3,1.1.4,1.2,1.2.1,1.2__beta5