ISPConfig3 又有安全更新(版本)了。
官方訊息
What's new in ISPConfig 3.0.5.4p7?
This release contains a security fix against a SQL injection attack and
a new protection against CSRF attacks. A problem that the public keys of
website ssh users were not saved into the .ssh directory of the home
directory of the user has been fixed as well.

The sql injection attack requires an active and correctly authenticated
admin user session. User sessions of Resellers, Clients or Mailusers can
not be used for the attack. Servers that have "sql_scan_action=block" set
in /usr/local/ispconfig/security/security_settings.ini are most likely
not affected as the ISPConfig SQL scan engine detecs this attack successfully,
the update should be installed anyway.

The "Reconfigure services" option can be answered with "no" on servers
that run ISPConfig 3.0.5.4p5 or p6.

See changelog link below for a list of all changes that are included in this release.

Download
The software can be downloaded here:

http://prdownloads.sourceforge.net/ispconfig/ISPConfig-3.0.5.4p7.tar.gz