CVE:CVE-2008-0390
CNNVD:CNNVD-200801-339
AuraCMS 1.62的stat.php以及AuraCMS 的Mod Block Statistik 存在远程脚本代码注入漏洞。远程攻击者可以通过stat操作中的HTTP 页眉中的X-Forwarded到达index.php来向online.db.txt的漏洞，注入任意PHP代码，并通过某个请求到达index.php来执行online.db.txt。
solution:Upgrade auracms auracms to a higher version than 1.62,and avoid the version 1.62; Upgrade auracms mod_block_statistik to a higher version than *