Apache Open For Business Project多个跨站脚本攻击漏洞

Apache Open For Business Project(又称OFBiz)被用在Opentaps、Neogia和Entente Oya上时，存在多个跨站脚本攻击漏洞。远程攻击者可以借助多个脚本的参数，注入任意的web脚本和HTML。这些参数包括：(1) control/exportProductListing的productStoreId参数；(2)partymgr/control/viewprofile (又称 partymgr/control/login)的partyId参数；(3)myportal/control/showPortalPage的start参数；(4)以/facility/control/ReceiveReturn (又称 /crmsfa/control/ReceiveReturn 或 /cms/control/ReceiveReturn)开头的URI；(5)ecommerce/control/ViewBlogArticle的contentId参数(又称entityName无效)；(6)webtools/control/FindGeneric的entityName参数；(7)ecommerce/control/contactus下未明组件的subject和content参数。