CVE:CVE-2006-0778
CNNVD:CNNVD-200602-272
XMB Forums 1.9.3及之前版本中存在多个SQL注入漏洞。远程攻击者可以借助(1)指向u2u.inc.php的$u2u_select数组参数和(2)today.php中的$val变量(fidpw0 cookie值)执行任意SQL命令。
solution:Upgrade xmb_forum xmb to a higher version than 1.9.3,and avoid the version (,1.9.3]