CVE:CVE-2010-4834
CNNVD:CNNVD-201109-215
OneOrZero AIMS 2.6.0 Members Edition和2.7.0 Trial Edition版本的index.php中存在多个SQL注入漏洞。远程认证用户可借助search_management_manage子控制器的saved_search操作中的id参数和show_item_search操作中的item_types参数执行任意SQL命令。
solution:Upgrade oneorzero aims to a higher version than 2.6.0,2.7.0,and avoid the version 2.6.0,2.7.0