CVE:CVE-2009-4172
CNNVD:CNNVD-200912-039
Cute News 是PHP文本 文章/新闻系统。当magic_quotes_gpc失效时，CutePHP CuteNews 1.4.6版本和UTF-8 CuteNews 8以及8b版本中的index.php的跨站脚本漏洞允许远程攻击者借助addnews操作中的news条款主体注入任意web脚本或HTML。
solution:Upgrade cutephp cutenews to a higher version than 1.4.6,and avoid the version 1.4.6; Upgrade korn19 utf-8_cutenews to a higher version than 8,8b,and avoid the version 8,8b