5 UCMS & amp; lt; = v1.2.2024 unverified background, SQL injection and repair

Brief description:
The background file is not verified, and the filtering is not strict, resulting in SQL injection.

Detailed description:
File Location admin/ajax. asp
24 rows Case "modeext"
..
26 rows ecid = Replace (Request ("cid "),"","")
27 rows cid = Replace (Request ("id ","","")
..
..
31 rows set rs = db ("select [modeext] from [{pre} change] where id =" & ecid, 1)
..
..
38 lines are similar to 31 descriptions

Because wherer id = accepts numeric values, it is not enough to filter single quotes here.

Proof of vulnerability:
Admin/ajax. asp? Act = modeext & cid = [SQL] & id = [SQL]

Fix: Filter