CVE:CVE-2008-0385
CNNVD:CNNVD-200802-525
Urulu中的server/widgetallocator.php中存在SQL注入漏洞。远程攻击者可以借助对index.php的connectionId参数执行任意的SQL指令。该index.php在PATH_INFO中的(1)statprt/js/request或(2)dyn/js/request目录下。
solution:Upgrade urulu urulu to a higher version than 2.1,and avoid the version 2.1