CVE:CVE-2008-1972
CNNVD:CNNVD-200804-386
Exponent CMS 0.96.6-GA20071003及其早期版本的用户帐户创建部件中的多个跨站脚本攻击漏洞, 在Allow Registration? 配置选项被激活的时候, 远程攻击者通过(1) 用户名, (2) 名, (3) 姓, 和(4) e-mail 地址字段来注入任意web脚本或HTML。
solution:Upgrade oicgroup exponent_cms to a higher version than 0.96.6-ga20071003,0.94,0.95,0.96.1,0.96.3,0.96.4,0.96.5:rc1,0.96.6,0.96.6:alpha,and avoid the version (,0.96.6-ga20071003],0.94,0.95,0.96.1,0.96.3,0.96.4,0.96.5:rc1,0.96.6,0.96.6:alpha