中易广告联盟系统(ZYADS) sql注入和本地包含漏洞

在index/news.php 1-31行 ? includeonce"top.php"; $newsid = intval$GET'id'; $totype = addslashes$GET'type'; if $totype=='index' $totypes =" and totype=1"; if $totype=='webuser' $totypes =" and totype!=3"; if $totype=='webadver' $totypes =" and totype!=2"; $newssql = 'select from zyadsnews WHERE id ='...