CVE:CVE-2005-3509
CNNVD:CNNVD-200511-141
JPortal是目前最为符合JSR-168Spec的Portal实现。
JPortal中的多个SQL注入漏洞可让远程攻击者通过(1) banner.php或(2) print.php、(3) comment.php和(4) news.php的id参数来执行任意SQL命令。
solution:Upgrade jportal jportal_web_portal to a higher version than 2.2.1,2.3.1,and avoid the version 2.2.1,2.3.1