Multiple Injection and repair solutions for children's parenting Network

Brief description:
 
 
There are multiple SQL injections in children's care network, which are not strictly filtered and user data is leaked.
Detailed description:
 
 
Web Server: nginx/1.0.6
 
DB Server: MySQL
 
Current DB: ad
 
Http://a1.goodbaby.com/ad_alt_js.php? Zoneid = 678
 
Http://ad.goodbaby.com/ad_multibyid.php? Zoneid = 1
 
Http://ad.goodbaby.com/ad_alt_click.php? Z = 227 & B = 230% 5C
 
Http://ad.goodbaby.com/ad_alt_js.php? Zoneid = 1
 
Http://www.goodbaby.com/tips/goodbaby/serials/default.php? Topic_id = 5 & chapter_id = 14 & article_id = 6817
 
 

 
 
Proof of vulnerability:
 
 
You can see a lot of user information...
 
 
 
Solution:
 
 
The. php page is not strictly filtered, leading to the SQL injection vulnerability and filtering some characters. Determine the information submitted by the user. When the submitted parameters contain SQL Injection characters such as "exec, insert, select, delete, from, update, count, and user, turn to the error page.
 
Lazy author @ wooyun