Ant php classification information system mymps 4.0i Multiple SQL Injection

Ant php classification information mymps 4.0i multiple characters are not filtered, there is a risk of injection, to help a friend solve the problem by the way, I hope the vendor to quickly patch
Detailed description:
/Include/common. fun. php 96-line get parameter filtering function Regular Expression
$ String = preg_replace ('/& amp; (# (\ d {} | x [a-fA-F0-9] {4 }) | [a-zA-Z] [a-z0-9] {2, 5});)/',' & \ 1 ',
Str_replace (array ('&', '"', '<', '>'), array ('& amp;', '& quot;', '& lt; ',' & gt; '), $ string ));
'Single quotation marks are not filtered here,
Horoscope www.2cto.com
Error page search. php category. php other pages not tested


 
 
Solution:
Filter all get inputs

Author king0war