Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3 when proxy mode is enabled allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Proxy Granting Ticket IOU (PGTiou) parameter to the callback function in client.php (2) vectors involving functions that make getCallbackURL calls or (3) vectors involving functions that make getURL calls.