Multiple cross-site scripting (XSS) vulnerabilities in index.php in PHP Web Scripts Easy Banner Free 2009.05.18 when magic_quotes_gpc is disabled allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl and (2) urlbanner parameters.