CVE:CVE-2008-6475
CNNVD:CNNVD-200903-267
Drake CMS 0.4.11版本及其早期版本的guestbook组件(components/guestbook/guestbook.php)中存在SQL注入漏洞。远程攻击者可以借助对index.php的HTTP页眉(HTTP_VIA)，执行任意SQL指令。
solution:Upgrade drake_team drake_cms to a higher version than 0.2.2.846,0.2.2_alpha_rev.846,0.3.2,0.3.3,0.3.4b,0.3.5,0.3.6,0.3.7,0.3.7_beta,0.3.8_beta,0.3.9,0.4.0,0.4.0b,0.4.1,0.4.10_rc6,0.4.11,0.2,and avoid the version (,0.2.2.846],(,0.2.2_alpha_rev.846],(,0.3.2],(,0.3.3],(,0.3.4b],(,0.3.5],(,0.3.6],(,0.3.7],(,0.3.7_beta],(,0.3.8_beta],(,0.3.9],(,0.4.0],(,0.4.0b],(,0.4.1],(,0.4.10_rc6],(,0.4.11],0.2