CVE:CVE-2007-6501
CNNVD:CNNVD-200712-279
Hosting Controller存在权限许可和访问控制漏洞，远程验证用户可以借助向adminsettings/choosetranstype.asp发送请求使"pay type"生效或失效。
solution:Upgrade hosting_controller hosting_controller to a higher version than 6.1_hotfix_3.3,and avoid the version (,6.1_hotfix_3.3]