CVE:CVE-2012-3873
CNNVD:CNNVD-201210-647
Open Constructor 3.12.0中存在多个SQL注入漏洞。通过id参数发送至（1）data/gallery/edit.php，(2)data/guestbook/edit.php，(3)data/file/edit.php，(4)data/htmltext/edit.php，(5)data/publication/edit.php，或者(6) data/event/edit.php，远程认证攻击者可利用该漏洞执行任意SQL命令。
solution:Upgrade openconstructor_project openconstructor to a higher version than 3.12.0,and avoid the version 3.12.0