CVE:CVE-2007-5189
CNNVD:CNNVD-200710-046
x-script GuestBook 1.3a中的mes_add.php存在多个SQL注入漏洞,当magic_quotes_gpc被禁用时,远程攻击者可以借助the (1) name, (2) email, (3) icq,以及(4) website参数执行任意SQL指令。
solution:Upgrade x-script guestbook to a higher version than 1.3a,and avoid the version 1.3a