CVE:CVE-2011-5213
CNNVD:CNNVD-201210-614
BrowserCRM 5.100.01和较早的版本中存在多个SQL注入漏洞。远程攻击者利用这些漏洞通过(1)login[username]参数传送到index.php脚本或(2)parent_id参数传送到modules/Documents/version_list.php脚本或(3)contact_id参数传送到modules/Documents/index.php脚本，执行任意SQL命令。
solution:Upgrade browsercrm browsercrm to a higher version than 5.100.01,4.604.01,4.605.00,4.607.00,4.610.00,4.611.01,4.612.00,4.614.00,4.615.10,4.615.11,4.616.00,4.617.00,4.619.00,4.620.01,4.622.00,4.624.00,4.624.01,4.624.50,4.624.60,4.624.70,4.624.80,4.624.90,4.691.01,4.999.20,5.000.00,5.000.01,5.001.00,5.002.00,5.100.00,and avoid the version (,5.100.01],4.604.01,4.605.00,4.607.00,4.610.00,4.611.01,4.612.00,4.614.00,4.615.10,4.615.11,4.616.00,4.617.00,4.619.00,4.620.01,4.622.00,4.624.00,4.624.01,4.624.50,4.624.60,4.624.70,4.624.80,4.624.90,4.691.01,4.999.20,5.000.00,5.000.01,5.001.00,5.002.00,5.100.00