CVE:CVE-2006-3300
CNNVD:CNNVD-200606-551
PHPMySMS是一款开放源码的用PHP实现的基于Web的短信解决方案。
PHPMySMS的实现上存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。
远程攻击者可以利用PHPMySMS的gateway.php文件中的远程文件包含漏洞执行任意PHP代码。漏洞代码如下：
==============================================================
if (($_POST[mode] == "1") or ($_GET[mode] == "1")) {
include ("config.php");
} else {
include ("$ROOT_PATH/config.php");
}
==============================================================
solution:Upgrade phpmysms phpmysms to a higher version than 2.0,and avoid the version (,2.0]