CVE:CVE-2007-1540
CNNVD:CNNVD-200703-451
(1)SQL-Ledger 2.6.27及之前版本和(2)LedgerSMB 1.2.0之前版本的am.pl中存在目录遍历漏洞。远程攻击者可以借助登陆参数中的..序列和拖动的空(%00)，运行任意可执行程序和绕过身份认证。
solution:Upgrade ledgersmb ledgersmb to a higher version than 1.1.8,and avoid the version (,1.1.8]; Upgrade sql-ledger sql-ledger to a higher version than 2.6.27,and avoid the version (,2.6.27]