CVE:CVE-2005-1562
CNNVD:CNNVD-200505-955
MaxWebPortal 1.3.5及更早版本存在多个SQL注入漏洞，远程攻击者可以通过(1)传给inc_functions.asp的fpassword参数，传给post_info.asp的(2)txtAddress，(3)message或(4)subject参数，传给search.asp的(5)andor参数，传给pop_profile.asp(6) 的verkey参数或传给pm_delete2.asp的(7)Remove或(8)Delete参数，来执行任意SQL命令。
solution:Upgrade maxwebportal maxwebportal to a higher version than 1.3.0,1.3.1,1.3.2,1.3.3,1.3.5,1.30,1.31,2.0,and avoid the version 1.3.0,1.3.1,1.3.2,1.3.3,1.3.5,1.30,1.31,2.0