https://www.exploit-db.com/exploits/26334
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200510-114

Aenovo是一款小巧的内容管理系统。(1)aeNovo，(2)aeNovoShop和(3)aeNovoWYSI存在多个SQL注入漏洞。远程攻击者可以借助可在产生的出错信息中实现XSS攻击的(a)control.asp的password参数和(b)search.asp的strSQL参数，执行任意SQL代码。

source: http://www.securityfocus.com/bid/15036/info
 
Aenovo, aeNovoShop and aeNovoWYSI are prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

AeNovo :Lists username and password of administrators
http://www.example.com/search.asp?strSQL=[SQL Injection]

来源:XF
名称:aenovo-xss(22553)
链接:http://xforce.iss.net/xforce/xfdb/22553
来源:XF
名称:aenovo-strsql-sql-injection(22551)
链接:http://xforce.iss.net/xforce/xfdb/22551
来源:XF
名称:aenovo-password-sql-injection(22547)
链接:http://xforce.iss.net/xforce/xfdb/22547
来源:BID
名称:15038
链接:http://www.securityfocus.com/bid/15038
来源:BID
名称:15036
链接:http://www.securityfocus.com/bid/15036
来源:MISC
链接:http://www.kapda.ir/advisory-78.html
来源:SECUNIA
名称:17117
链接:http://secunia.com/advisories/17117/
来源:BUGTRAQ
名称:20051007AenovoMultipleVulnerabilities
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=112872593432359&w;=2
来源:OSVDB
名称:19937
链接:http://www.osvdb.org/19937
来源:OSVDB
名称:19936
链接:http://www.osvdb.org/19936