CVE:CVE-2009-4046
CNNVD:CNNVD-200911-226
FrontAccounting (FA) 2.2 RC之前的2.2.x版本中存在多个SQL注入漏洞。远程攻击者可以借助提交到gl/manage/中的(1)bank_accounts.php,(2) currencies.php,(3)exchange_rates.php,(4)gl_account_types.php和(5)gl_accounts.php；includes/db/中的(6)audit_trail_db.inc,(7) comments_db.inc,(8) inventory_db.inc,(9)manufacturing_db.inc和(10)references_db.inc的未明参数，执行任意的SQL指令。
solution:Upgrade frontaccounting frontaccounting to a higher version than 2.2:beta,and avoid the version 2.2:beta