CVE:CVE-2006-3010
CNNVD:CNNVD-200606-293
Open Business Management (OBM) 1.0.3 pl1存在多个SQL注入漏洞，远程攻击者可通过传给(a)index.php，(b)group/group_index.php，(c)user/user_index.php，(d)list/list_index.php和(e)company/company_index.php的(1)new_order和(2)order_dir参数，以及传给company/company_index.php的(3)entity和(4)tf_dateafter参数来执行任意SQL命令。
solution:Upgrade aliacom open_business_management to a higher version than 1.0.3_pl1,and avoid the version 1.0.3_pl1