CVE:CVE-2007-6495
CNNVD:CNNVD-200712-284
Hosting Controller 6.1 Hot fix 3.3版本及其早期版本的inc_newuser.asp使远程验证用户可以修改一个对accounts/AccountActions.asp的AddUser操作的Dirroot参数，在WEB脚本下任意位置改变名为(1) db, (2) www, (3) Special,和(4) log的目录许可。
solution:Upgrade hosting_controller hosting_controller to a higher version than 6.1_hotfix_3.3,and avoid the version 6.1_hotfix_3.3