EmpireCMS commodity scoring plug-in Injection

Because the parameter variables are not initialized, the $ id variables in pf \ rate. php and pf \ ratemovie. php are prone to injection risks. $ Id = $ _ GET ['id']; $ query = "SELECT infopfen, infopfennum FROM phome_ecms_shop WHERE id = $ id"; $ result = mysql_query ($ query ); $ v = $ _ GET ['V']; $ id = $ _ GET ['id']; $ query = "UPDATE phome_ecms_shop SET infopfen = infopfen + $ v, infopfennum = infopfennum + 1 WHERE id = $ id "; $ result = mysql_query ($ query); $ query =" SELECT infopfen, infopfennum FROM phome_ecms_shop WHERE id = $ id "; $ result = mysql_query ($ query );Solution:

Filter