CVE:CVE-2006-3152
CNNVD:CNNVD-200606-410
phpTRADER 4.9 SP5及之前版本存在多个SQL注入漏洞。远程攻击者可以借助(a) login.php, (b) write_newad.php, (c) newad.php, (d) printad.php, (e) askseller.php, (f) browse.php, (g) showmemberads.php, (h) note_ad.php, (i) abuse.php, (j) buynow.php, (k) confirm_newad.php中的 (1) sectio参数, (l) printad.php, (m) note_ad.php中的(2) an参数, (n) showmemberads.php中的(3) who 参数, 以及(o) buynow.php中的 (4) adnr参数，执行任意SQL命令。
solution:Upgrade bluehouse_project phptrader to a higher version than 4.9_sp5,and avoid the version 4.9_sp5