CVE:CVE-2005-4366
CNNVD:CNNVD-200512-412
DRZES HMS 3.2中存在多个SQL注入漏洞，远程攻击者可以通过(1) (a) domains.php， (b) viewusage.php， (c) pop_accounts.php， (d) databases.php， (e) ftp_users.php， (f) crons.php， (g) pass_dirs.php， (h) zone_files.php， (i) htaccess.php和 (j) software.php的plan_id参数； (2) viewplan.php的customerPlanID参数； (3)referred_plans.php的ref_id参数； (4) listcharges.php的customerPlanID参数；和(5) (k) pop_accounts.php，(d) databases.php，(e) ftp_users.php， (f) crons.php， (g) pass_dirs.php，(h) zone_files.php，(i) htaccess.php和(j) software.php的domain参数执行任意SQL命令。
solution:Upgrade fad_solutions drzes_hms to a higher version than 3.2,and avoid the version 3.2