CVE:CVE-2005-3872
CNNVD:CNNVD-200511-462
Ugroup是一款基于PHP和MySQL实现的在线讨论区软件。
Ugroup 2.6.2及更早版本存在多个SQL注入漏洞，可让远程攻击者通过(1) forum.php中的FORUM_ID参数，以及topic.php中的(2) TOPIC_ID、(3) FORUM_ID和(4) CAT_ID 参数执行任意SQL命令。
solution:Upgrade ugroup ugroup to a higher version than 2.6.2,and avoid the version (,2.6.2]
solution:Upgrade multitheftauto multitheftauto to a higher version than 0.5_patch_1,and avoid the version (,0.5_patch_1]