SQL blind injection due to unfiltered video game bus parameters + Microsoft IIS File Enumeration

Time Difference-based SQL blind injection. http://wowdb.tgbus.com/zones.aspx? C = 6 (parameter c unfiltered) http://wowdb.tgbus.com//npcs.aspx? Aid = & cid = 3 (cid not filtered) Why didn't I fix the one mentioned in the second one? In addition, many parameters are not filtered, but injection is not allowed, but sensitive information is leaked. Many of the. Microsoft IIS File enumeration vulnerabilities you know can obtain sensitive information to guess files. However, this vulnerability is difficult to guess.
Microsoft IIS File enumeration is a simple guess. poc is available on the Internet. The online POC can run. In a simple manual test, this certainly returns 404. A may not start with 400.
 Solution:

There are indeed many vulnerabilities on this website. It is recommended that you carefully check and fix them... other background vulnerabilities can be bypassed because they are not filtered out. You do not know the enumeration vulnerability --...