Editor upload vulnerability in the official SQL injection and Default background of the smart phone Edition

The following are official vulnerabilities in smart phone:
1. SQL Injection
2. Default ADMIN directory in the background
3. FCKeditor uploads a webshell file for Elevation of Privilege.

The above three points only identify problems and do not take webshell operations.
Proof of vulnerability:
1. Inject point: http://mo.gw.com.cn/type.php? Typeid = 1560.

 
 

2. Default background directory/admin/
Http://mo.gw.com.cn/admin/

Www.2cto.com
3. fckeditor
Http://mo.gw.com.cn/admin/editor/editor/filemanager/browser/default/browser.html? Type = Image & Connector = http % 3A % 2F % 2Fmo.gw.com.cn % 2 Fadmin % 2 Feditor % 2 Feditor % 2 Ffilemanager % 2 Fconnectors % 2 Fphp % 2fconne. php
Solution:
The suggestions are as follows:
1. Filter SQL Injection
2. Modify the background path
3. Configure the fckeditor directory to verify the user before access.
Author Lmy