CVE:CVE-2006-4276
CNNVD:CNNVD-200608-333
Tutti Nova 1.6及早期版本中存在PHP远程文件包含漏洞，远程攻击者可借助提交到novalib/class.novaEdit.mysql.php脚本中TNLIB_DIR参数中的URL执行任意PHP代码。
solution:Upgrade tutti_nova tutti_nova to a higher version than 1.6,and avoid the version (,1.6]