CVE:CVE-2007-6498
CNNVD:CNNVD-200712-283
Hosting Controller 6.1 Hot fix 3.3版本及其早期版本存在多个SQL注入漏洞，远程验证用户可以借助(1) email和(2)Hosting/Addreseller.asp的登录名参数, (3)accounts/accountmanager.asp的种类字段参数, (4)OpenApi/GatewayVariables.asp的GateWayid参数,以及可能的(5) IIS/iibind.asp的未明向量执行任意SQL指令。
solution:Upgrade hosting_controller hosting_controller to a higher version than 6.1_hotfix_3.3,and avoid the version 6.1_hotfix_3.3