[原文]Multiple cross-site scripting (XSS) vulnerabilities in Photo Album 2.0.53 module for phpBB allow remote attackers to inject arbitrary web script or HTML via the bsid parameter to (1) album_cat.php or (2) album_comment.php.
Smartor Photo Album for phpBB album_cat.php bsid Parameter XSS
Remote / Network Access
Loss of Integrity
Smartor Photo Album for phpBB contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'bsid' variable upon submission to the 'album_cat.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.
NOTE: Subsequent examination after vendor dispute suggests there are no occurances of a "bsid" variable in the Smartor Photo Album distribution. It is possible this issue applies to custom installations, or unsanitized variables in phpBB are passed to this script.
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.