Site X-Powered-By: WAF/2.0 still exploitable?

Also browser exploitable issue for Web application details:
Application: DESTOON B2B - www.destoon.com
http://www.securityfocus.com/bid/45796/exploit
As the WAF/2.0 issue info spread via excessive header info proliferation.
a WAF does not protect against SQLi attacks - databases are still exposed.
Site should be flagged because of blacklisted external link: htxp://js.users.51.la/17215221.js
Blacklisted domains, hosts: app.adanzhuo dot com → https://www.virustotal.com/nl/url/9f0a12365f9b68edbcae04faa568a8e979dfa39ec0bcbe05a039d2cf86a69028/analysis/
www.xstyjc dot com (malicious software host - http://www.google.mn/safebrowsing/diagnostic?site=xstyjc.com/ )
js.users.51 dot la (already mentioned)

polonus

Read about a similar hack attack on site here: http://www.grafxsoftware.com/faq.php/Web-Site-hacked-iframe-inserted-where-to-start/1/14/

polonus

Update and returning to a likewise scenario given at Viruswatch: http://killmalware.com/18719.loan/
Also found this script there: http://www.domxssscanner.com/scan?url=http%3A%2F%2F404.safedog.cn%2FScripts%2Furl.js
and see: http://toolbar.netcraft.com/site_report?url=http://404.safedog.cn
Google blacklisted - https://asafaweb.com/Scan?Url=18719.loan & https://urlquery.net/report.php?id=1467145561356
WAF 2.0 on website can be bypassed with WAF skip comments: https://www.exploit-db.com/exploits/36369/
http://www.domxssscanner.com/scan?url=http%3A%2F%2F18719.loan%2Findex.html

pol