source: https://www.securityfocus.com/bid/5793/info
acWEB is prone to cross-site scripting attacks. It is possible to construct a malicious link to the web server which contains arbitrary script code. When the link is visited, the script code will be executed in the web client of the user visiting the link. The code will be executed in the context of the webserver.
http://www.victim.com/%db<script>alert('test');</script>/