CVE:CVE-2005-2865
CNNVD:CNNVD-200509-068
aMember Pro是一款基于PHP的会员和订阅管理系统。
aMember Pro 2.3.4版本中多个PHP远程文件包含漏洞允许远程攻击者通过配置[root_dir]参数执行任意PHP代码到以下文件：(1) mysql.inc.php， (2) efsnet.inc.php， (3) theinternetcommerce.inc.php， (4) cdg.inc.php， (5) compuworld.inc.php， (6) directone.inc.php， (7) authorize_aim.inc.php， (8) beanstream.inc.php， (9) config.inc.php， (10) eprocessingnetwork.inc.php， (11) eway.inc.php， (12) linkpoint.inc.php， (13) logiccommerce.inc.php， (14) netbilling.inc.php， (15) payflow_pro.inc.php， (16) paymentsgateway.inc.php， (17) payos.inc.php， (18) payready.inc.php， 或 (19) plugnplay.inc.php。
solution:Upgrade amember amember to a higher version than 2.3.4,and avoid the version 2.3.4