Livcms Content Management System injection vulnerability and repair

This program is mostly used for Satellite TV in various regions of network media. The program directory is comment_stat.php and comment_js.php under dealfunc,
The cmid is not filtered. Direct Injection.
The Default background address is http://cp.xxxx.com/ws
Comment_stat.php file source code
 
<? Php
/**
* Comment_stat.php: Comment reply Statistical File: dealfunc
*
* $ Id: comment_stat.php 67 2007-06-01 03: 48: 20Z $
*/
Define ('include _ path ','./../');
Require_once "./../liv_global.php ";
$ Staticfile = $ _ REQUEST ['staticfile'];
$ Commresult = $ DB-> query_first ("SELECT count (*) as cmtnum FROM liv_comment where contentid = ". $ _ REQUEST ['cmid']. "and auditing = 1 ");
 
?>
Document. write ('<? Php echo intval ($ commresult ['cmtnum']);?> ');
<? Php
 
?>
Source code of the file www.2cto.com comment_js.php
 
<? Php
/**
* Comment_js.php: comments. JS call: dealfunc
*
* $ Id: comment_js.php 67 2007-06-01 03: 48: 20Z $
*/
Define ('include _ path ','./../');
Require "./../liv_global.php ";
 
$ Cmid = $ _ REQUEST ['cmid'];
If ($ cmid)
{
$ Cond = 'AND contentid ='. $ cmid;
}
$ Limit = intval ($ _ REQUEST ['limit'])? Intval ($ _ REQUEST ['limit']): 6;
$ Brieflength = intval ($ _ REQUEST ['brieflength '])? Intval ($ _ REQUEST ['brieflength']): 100;
 
?>
Document. write ('<ul style = "border-bottom: 1px solid # ccc; margin-bottom: 10px;"> <li style = "font-size: 14px; font-weight: bold; "> comment: </li> ');
<? Php
 
$ Result = $ DB-> query ("SELECT * FROM ". DB_PREFIX. "comment WHERE auditing = 1 and siteid = ". intval ($ siteinfo ['siteid']). $ cond. "order by pubdate desc limit $ limit ");
// Echo "SELECT * FROM ". DB_PREFIX. "comment WHERE auditing = 1 and siteid = ". intval ($ siteinfo ['siteid']). $ cond. "and contentid = ". $ cmid. "order by pubdate desc limit $ limit ";
$ Rst = $ DB-> num_rows ($ result );
// $ Commentlink = $ siteinfo ['sitepath']. 'comment/comment. php? Cmid = '. $ cmid.' & modeid = '. $ modeid;
$ Commentlink = $ siteinfo ['sitepath']. 'comment/comment. php? Cmid = '. $ cmid;
While ($ row = $ DB-> fetch_array ($ result ))
{
$ Content = cutchars ($ row ['content'], $ brieflength );
// $ Content = nl2br ($ content );
$ Content = str_replace (array (chr (10), chr (13), "", $ content );
$ Pubdate = date ('Y-m-d', $ row ['pubdate']);
$ Author = $ row ['author'];
$ Ips = explode (".", $ row ['IP']);
$ Newip = $ ips [0]. '.'. $ ips [1]. '. *. *';
$ Link = $ siteinfo ['weburl']. 'comment/comment. php? Cmid = '. $ row ['tentid'];
?>
Document. write ('<li style = "background: # f1f1f1; border-bottom: 1px solid # d8d8d8; padding: 5px;"> User: <B> <? Php echo $ author?> </B> time: <? Php echo $ pubdate?> IP: <? Php echo $ newip?> </Li> <li style = "line-height: 22px; padding: 5px;"> <a href = "<? Php echo $ link?> "Target =" _ blank "> <? Php echo $ content;?> </A> </li> ');
<? Php
}
If ($ rst! = 0)
{
?>
Document. write ('<li style = "text-align: right; line-height: 22px; font-weight: bold; padding-right: 10px; "> <a href =" <? Php echo $ commentlink?> "Target =" _ blank "> more messages </a> </li> ');
<? Php
}
?>
Document. write ('</ul> ');
<? Php
 
?>
Without any filtering, directly bring it into the query

 
Solution:

To filter or directly delete files in this directory,