CVE:CVE-2009-4224
CNNVD:CNNVD-200912-086
SweetRice是一款普通的WEB站点管理软件。SweetRice 0.5.4, 0.5.3及其早期版本中存在多个PHP远程文件包含漏洞，远程攻击者可以借助对(1) _plugin/subscriber/inc/post.php和(2) as/lib/news_modify.php的root_dir参数的一个URL执行任意PHP代码。
solution:Upgrade basic-cms sweetrice to a higher version than 0.5.4,0.2.0,0.2.1,0.3.0,0.3.1,0.4.0,0.4.1,0.4.2,0.4.4,0.5.0,0.5.1,0.5.2,0.5.3,and avoid the version (,0.5.4],0.2.0,0.2.1,0.3.0,0.3.1,0.4.0,0.4.1,0.4.2,0.4.4,0.5.0,0.5.1,0.5.2,0.5.3