CVE:CVE-2008-1272
CNNVD:CNNVD-200803-149
BM Classifieds 20080309以及之前的版本中的多个SQL注入漏洞，远程攻击者借助(1)到showad.php的cat参数；(2)到pfriendly.php的ad参数，执行任意的SQL指令。
solution:Upgrade bmscripts bm_classifieds to a higher version than 20080309,and avoid the version (,20080309]