CVE:CVE-2006-1590
CNNVD:CNNVD-200604-027
通过BASE中的(a)到base_graph_main.php的back参数，(b)到base_stat_ipaddr.php的netmask参数，或者(c)到base_qry_alter.php的submit参数，或者(d)ACID中到acid_main.php的query字符串，(1)基本分析和安全引擎(BASE)1.2.4和(2)入侵数据库的分析控制台(ACID)0.9.6b23可让远程攻击者注入任意Web脚本或HTML。
solution:Upgrade kevin_johnson basic_analysis_and_security_engine to a higher version than 0.9.7,0.9.7.1,0.9.8,0.9.9,1.0,1.0.1,1.0.2,1.1,1.1.2,1.1.3,1.1.4,1.2.0,1.2.1,1.2.2,1.2.4,and avoid the version 0.9.7,0.9.7.1,0.9.8,0.9.9,1.0,1.0.1,1.0.2,1.1,1.1.2,1.1.3,1.1.4,1.2.0,1.2.1,1.2.2,1.2.4; Upgrade roman_danyliw analysis_console_for_intrusion_databases_(acid) to a higher version than 0.9.6b23,and avoid the version 0.9.6b23