CVE:CVE-2009-4478
CNNVD:CNNVD-200912-419
Xstate Real Estate中存在多个跨站脚本攻击漏洞。远程攻击者可以借助对(1) home.html 或 (2) lands.html的PATH_INFO，注入任意web脚本或HTML。
solution:Upgrade xstate real_estate to a higher version than 1.0,and avoid the version 1.0