Netgear official forum SQL injection + entry to the background + administrator and user information leakage

Download Page http://neclub.netgear.com.cn/nebs/downloads.asp? PageIndex = 100 & ID = 20 ID filtering is lax, resulting in SQL injection (although asp is used, the database is configured with SQL server 2008 ...) Http://neclub.netgear.com.cn/nebs/downloads.asp? PageIndex = 1 & ID = 20 and 1 = 0 union select 1, UserPassword, UserName, 4, 5, 6, 7, 8 from BBSXP_Users -- is this item BBSXP? I'm not familiar with it... But I found no other BBSXP files... Secondary Development... I found an administrator named jing. gu. I lost my password hash and checked it out...
If the background login is successful, the system will not proceed further...

 Solution:

Filter IDS