CVE:CVE-2005-1948
CNNVD:CNNVD-200506-069
Invision Gallery 1.3.1之前的版本中存在多个SQL注入漏洞，远程攻击者可借助：(1)editcomment操作中的comment参数，或(2)推选图片时的rating参数，来执行任意SQL指令。
solution:Upgrade invision_power_services invision_gallery to a higher version than 1.0.1,1.3,and avoid the version 1.0.1,1.3