CVE:CVE-2010-4770
CNNVD:CNNVD-201103-304
CommodityRentals DVD Rentals Script的index.php中存在SQL注入漏洞。当"view"设为"catalog"并且"item_type"设为"M"时，向index.php文件输入的"cat_id"参数还没经过正确过滤就被用于SQL查询。远程攻击者可以通过注入任意SQL代码执行SQL查询。
solution:Upgrade commodityrentals dvd_rentals_script to a higher version than *