CVE:CVE-2012-3469
CNNVD:CNNVD-201208-126
Ushahidi Platform 2.5之前版本中存在多个SQL注入漏洞。远程攻击者可利用这些漏洞通过与(1)application/controllers/admin/messages.php中的消息管理功能(2)application/libraries/api/MY_Checkin_Api_Object.php(3)application/controllers/admin/messages/reporters.php或(4)application/libraries/api/MY_Locations_Api_Object.php和application/models/location.php中的location API相关的向量执行任意SQL命令。
solution:Upgrade ushahidi ushahidi_platform to a higher version than 2.4.1,1.0,1.2,2.0,2.1,2.2,2.2.1,2.3.1,2.3.2,2.4,and avoid the version (,2.4.1],1.0,1.2,2.0,2.1,2.2,2.2.1,2.3.1,2.3.2,2.4