CVE:CVE-2012-0805
CNNVD:CNNVD-201203-182
SQLAlchemy 0.7.0b4之前版本中存在多个SQL注入漏洞，这些漏洞源于通过limit"和"offset"关键词向"select()"函数传递的输入，在用于SQL查询之前未经正确过滤。攻击者可通过注入任意SQL代码，操控SQL查询。
solution:Upgrade sqlalchemy sqlalchemy to a higher version than *:b3,0.6.0,0.6.0:beta1,0.6.0:beta2,0.6.0:beta3,0.6.1,0.6.2,0.6.3,0.6.4,0.6.5,0.6.6,0.6.7,0.7.0:b1,0.7.0:b2,and avoid the version *:b3,0.6.0,0.6.0:beta1,0.6.0:beta2,0.6.0:beta3,0.6.1,0.6.2,0.6.3,0.6.4,0.6.5,0.6.6,0.6.7,0.7.0:b1,0.7.0:b2