CVE:CVE-2011-0432
CNNVD:CNNVD-201103-195
PyWebDAV 0.9.4.1之前版本中存在多个SQL注入漏洞。由于向DAVServer/mysqlauth.py中的MySQLAuthHandler类()的"get_userinfo()"方法传递的"user"和"pw"参数还没有经过正确过滤就被用于SQL查询，导致执行任意SQL命令。
solution:Upgrade simon_pamies pywebdav to a higher version than 0.9.4,0.3,0.5,0.5.1,0.6,0.7,0.8,0.9.1,0.9.2,0.9.3,and avoid the version (,0.9.4],0.3,0.5,0.5.1,0.6,0.7,0.8,0.9.1,0.9.2,0.9.3