https://www.exploit-db.com/exploits/23824
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200403-083

MamboOpenSource4.5stable1.0.3以及以前的版本的index.php存在跨站脚本攻击(XSS)漏洞。远程攻击者借助（1）return或（2）mos_change_template参数注入任意web脚本或HTML。

source: http://www.securityfocus.com/bid/9890/info

It has been reported that the Mambo 'index.php' script is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly validate user supplied URI input. This issue could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/index.php?return=[XSS]

来源:OSVDB
名称:4665
链接:http://www.osvdb.org/4665
来源:SECUNIA
名称:11140
链接:http://secunia.com/advisories/11140
来源:BUGTRAQ
名称:20040316MamboOpenSourceMultipleVulnerabilities
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=107945576020593&w;=2
来源:XF
名称:mambo-return-moschangetemplate-xss(15499)
链接:http://xforce.iss.net/xforce/xfdb/15499
来源:BID
名称:9890
链接:http://www.securityfocus.com/bid/9890
来源:OSVDB
名称:4308
链接:http://www.osvdb.org/4308