https://www.exploit-db.com/exploits/21552
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-834

PHPClassifieds是一款基于WEB的PHP编写的目录分类程序。PHPClassifieds对用户提交给的参数缺少正确充分的过滤，远程攻击者可以利用这个漏洞进行跨站脚本执行攻击。PHPClassifieds包含的latestwap.php脚本中的URL参数对用户提交的数据缺少过滤，攻击者可以构建包含恶意代码URL参数的链接，当用户查看此链接时，包含的恶意脚本代码就会在用户浏览器行执行，导致用户基于Cookie认证的信息泄露。

source: http://www.securityfocus.com/bid/5022/info

PHP Classifieds has been reported to be prone to cross-site scripting attacks. Attackers may inject arbitrary HTML or script code into URI parameters in a malicious link. When the malicious link is visited, the attacker's script code will be executed in the web client of the user browsing the link, in the security context of the website hosting the vulnerable software. 

http://target/phpclassifieds/latestwap.php?url=<script>alert('OopS');<

来源:XF
名称:phpclassifieds-parameters-css(9363)
链接:http://xforce.iss.net/xforce/xfdb/9363
来源:BID
名称:5022
链接:http://www.securityfocus.com/bid/5022
来源：NSFOCUS
名称：2984
链接：http://www.nsfocus.net/vulndb/2984