### 简要描述： ... ### 详细说明： 某政府系统通用SQL注入24处打包。 案例：（23处GET注入+1处POST注入） 23处GET注入： http://www.whaac.gov.cn:8080/BusinessRegistration/BR_ProjectList.aspx?page=1&procode= http://www.cfdonline.org.cn/OutPortal_CFD//BusinessRegistration/BR_ProjectList.aspx?page=1&procode= http://www.rcsp.cn/BusinessRegistration/BR_ProjectList.aspx?page=1&procode= http://222.135.78.34/BusinessRegistration/BR_ProjectList.aspx?page=1&procode= http://www.rczw.gov.cn/BusinessRegistration/BR_ProjectList.aspx?page=1&procode= http://www.whaac.gov.cn:8080/ProJectControl/LS_ProjectList.aspx?page=1&procode= http://www.cfdonline.org.cn/OutPortal_CFD//ProJectControl/LS_ProjectList.aspx?page=1&procode= http://www.rczw.gov.cn/ProJectControl/LS_ProjectList.aspx?page=1&procode= http://www.rcsp.cn/ProJectControl/LS_ProjectList.aspx?page=1&procode= http://222.135.78.34/ProJectControl/LS_ProjectList.aspx?page=1&procode= http://www.rcsp.cn/ViewSource/FujianDownLoad.aspx?id=1...
### 简要描述： ... ### 详细说明： 某政府系统通用SQL注入24处打包。 案例：（23处GET注入+1处POST注入） 23处GET注入： http://www.whaac.gov.cn:8080/BusinessRegistration/BR_ProjectList.aspx?page=1&procode= http://www.cfdonline.org.cn/OutPortal_CFD//BusinessRegistration/BR_ProjectList.aspx?page=1&procode= http://www.rcsp.cn/BusinessRegistration/BR_ProjectList.aspx?page=1&procode= http://222.135.78.34/BusinessRegistration/BR_ProjectList.aspx?page=1&procode= http://www.rczw.gov.cn/BusinessRegistration/BR_ProjectList.aspx?page=1&procode= http://www.whaac.gov.cn:8080/ProJectControl/LS_ProjectList.aspx?page=1&procode= http://www.cfdonline.org.cn/OutPortal_CFD//ProJectControl/LS_ProjectList.aspx?page=1&procode= http://www.rczw.gov.cn/ProJectControl/LS_ProjectList.aspx?page=1&procode= http://www.rcsp.cn/ProJectControl/LS_ProjectList.aspx?page=1&procode= http://222.135.78.34/ProJectControl/LS_ProjectList.aspx?page=1&procode= http://www.rcsp.cn/ViewSource/FujianDownLoad.aspx?id=1 http://www.whaac.gov.cn:8080/ViewSource/FujianDownLoad.aspx?id=1 http://222.135.78.34/ViewSource/FujianDownLoad.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD/ViewSource/FujianDownLoad.aspx?id=1 http://www.rczw.gov.cn/ViewSource/FujianDownLoad.aspx?id=1 http://www.rcsp.cn/ViewSource/PrintDownLoad.aspx?id=1 http://www.whaac.gov.cn:8080/ViewSource/PrintDownLoad.aspx?id=1 http://222.135.78.34/ViewSource/PrintDownLoad.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD/ViewSource/PrintDownLoad.aspx?id=1 http://www.rczw.gov.cn/ViewSource/PrintDownLoad.aspx?id=1 http://www.rcsp.cn//SecondPages/ItemObjectList.aspx?id=1 http://www.whaac.gov.cn:8080/SecondPages/ItemObjectList.aspx?id=1 http://222.135.78.34/SecondPages/ItemObjectList.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD/SecondPages/ItemObjectList.aspx?id=1 http://www.rczw.gov.cn/SecondPages/ItemObjectList.aspx?id=1 http://www.rcsp.cn//SecondPages/ItemDetail.aspx?id=1 http://www.whaac.gov.cn:8080//SecondPages/ItemDetail.aspx?id=1 http://222.135.78.34//SecondPages/ItemDetail.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD//SecondPages/ItemDetail.aspx?id=1 http://www.rczw.gov.cn//SecondPages/ItemDetail.aspx?id=1 http://www.rcsp.cn//SecondPages/itemsearchlist.aspx?id=1 http://www.whaac.gov.cn:8080//SecondPages/itemsearchlist.aspx?id=1 http://222.135.78.34//SecondPages/itemsearchlist.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD//SecondPages/itemsearchlist.aspx?id=1 http://www.rczw.gov.cn//SecondPages/itemsearchlist.aspx?id=1 http://www.rcsp.cn/Qiyezhuce/Huanyingguanlin.aspx?id=1 http://www.whaac.gov.cn:8080/Qiyezhuce/Huanyingguanlin.aspx?id=1 http://222.135.78.34/Qiyezhuce/Huanyingguanlin.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD/Qiyezhuce/Huanyingguanlin.aspx?id=1 http://www.rczw.gov.cn/Qiyezhuce/Huanyingguanlin.aspx?id=1 http://www.rcsp.cn/Qiyezhuce/Yicixinggaozhi.aspx?id=1 http://www.whaac.gov.cn:8080/Qiyezhuce/Yicixinggaozhi.aspx?id=1 http://222.135.78.34/Qiyezhuce/Yicixinggaozhi.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD/Qiyezhuce/Yicixinggaozhi.aspx?id=1 http://www.rczw.gov.cn/Qiyezhuce/Yicixinggaozhi.aspx?id=1 http://www.rcsp.cn/login/itemList.aspx?id=1 http://www.whaac.gov.cn:8080/login/itemList.aspx?id=1 http://222.135.78.34/login/itemList.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD/login/itemList.aspx?id=1 http://www.rczw.gov.cn/login/itemList.aspx?id=1 http://www.rcsp.cn//FormPage/AttDownLoad.aspx?id=1 http://www.whaac.gov.cn:8080//FormPage/AttDownLoad.aspx?id=1 http://222.135.78.34//FormPage/AttDownLoad.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD//FormPage/AttDownLoad.aspx?id=1 http://www.rczw.gov.cn//FormPage/AttDownLoad.aspx?id=1 http://www.rcsp.cn/FormControl/AttDownLoad.aspx?id=1 http://www.whaac.gov.cn:8080/FormControl/AttDownLoad.aspx?id=1 http://222.135.78.34/FormControl/AttDownLoad.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD/FormControl/AttDownLoad.aspx?id=1 http://www.rczw.gov.cn/FormControl/AttDownLoad.aspx?id=1 http://www.rcsp.cn/FormControl/PubFormPage.aspx?formId=1 http://www.whaac.gov.cn:8080/FormControl/PubFormPage.aspx?formId=1 http://222.135.78.34/FormControl/PubFormPage.aspx?formId=1 http://www.cfdonline.org.cn/OutPortal_CFD/FormControl/PubFormPage.aspx?formId=1 http://www.rczw.gov.cn/FormControl/PubFormPage.aspx?formId=1 http://www.rcsp.cn/EmbedPage/itemsearchlist1.aspx?id=1 http://www.whaac.gov.cn:8080/EmbedPage/itemsearchlist1.aspx?id=1 http://222.135.78.34/EmbedPage/itemsearchlist1.aspx?id=1 http://www.cfdonline.org.cn/OutPortal_CFD/EmbedPage/itemsearchlist1.aspx?id=1 http://www.rczw.gov.cn/EmbedPage/itemsearchlist1.aspx?id=1 http://221.2.149.28:8090/zjcs/SecondPages/ItemDetail.aspx?id=1 http://www.whaac.gov.cn:8090/zjcs/SecondPages/ItemDetail.aspx?id=1 http://www.rszwfwzx.gov.cn:8080/zjcs/SecondPages/ItemDetail.aspx?id=1 http://www.wdaac.cn/zjcs/SecondPages/ItemDetail.aspx?id=1 http://222.135.78.37:8084/zjcs/SecondPages/ItemDetail.aspx?id=1 http://221.2.149.28:8090/zjcs/SecondPages/itemsearchlist.aspx?id=1 http://www.whaac.gov.cn:8090/zjcs/SecondPages/itemsearchlist.aspx?id=1 http://www.rszwfwzx.gov.cn:8080/zjcs/SecondPages/itemsearchlist.aspx?id=1 http://www.wdaac.cn/zjcs/SecondPages/itemsearchlist.aspx?id=1 http://222.135.78.37:8084/zjcs/SecondPages/itemsearchlist.aspx?id=1 http://221.2.149.28:8090/zjcs/SecondPages/ItemObjectList.aspx?id=1 http://www.whaac.gov.cn:8090/zjcs/SecondPages/ItemObjectList.aspx?id=1 http://www.rszwfwzx.gov.cn:8080/zjcs/SecondPages/ItemObjectList.aspx?id=1 http://www.wdaac.cn/zjcs/SecondPages/ItemObjectList.aspx?id=1 http://222.135.78.37:8084/zjcs/SecondPages/ItemObjectList.aspx?id=1 http://221.2.149.28:8090/zjcs/login/ItemList.aspx?id=1 http://www.whaac.gov.cn:8090/zjcs/login/ItemList.aspx?id=1 http://www.rszwfwzx.gov.cn:8080/zjcs/login/ItemList.aspx?id=1 http://www.wdaac.cn/zjcs/login/ItemList.aspx?id=1 http://222.135.78.37:8084/zjcs/login/ItemList.aspx?id=1 http://221.2.149.28:8090/zjcs/issue/similarPaid.aspx?zhongjieID=ZJJG_2015030914101257487 http://www.whaac.gov.cn:8090/zjcs/issue/similarPaid.aspx?zhongjieID=ZJJG_2015030914101257487 http://www.rszwfwzx.gov.cn:8080/zjcs/issue/similarPaid.aspx?zhongjieID=ZJJG_2015030914101257487 http://www.wdaac.cn/zjcs/issue/similarPaid.aspx?zhongjieID=ZJJG_2015030914101257487 http://222.135.78.37:8084/zjcs/issue/similarPaid.aspx?zhongjieID=ZJJG_2015030914101257487 http://221.2.149.28:8090/zjcs/issue/similarItemList.aspx?dic_code=SYLDKXXBG http://www.whaac.gov.cn:8090/zjcs/issue/similarItemList.aspx?dic_code=SYLDKXXBG http://www.rszwfwzx.gov.cn:8080/zjcs/issue/similarItemList.aspx?dic_code=SYLDKXXBG http://www.wdaac.cn/zjcs/issue/similarItemList.aspx?dic_code=SYLDKXXBG http://222.135.78.37:8084/zjcs/issue/similarItemList.aspx?dic_code=SYLDKXXBG http://222.135.78.37:8084/zjcs/issue/similarPaidList1.aspx?item_id=1ed1f0c7-e89f-4ace-b952-89edbf207624 http://www.whaac.gov.cn:8090/zjcs/issue/similarPaidList1.aspx?item_id=1ed1f0c7-e89f-4ace-b952-89edbf207624 http://www.rszwfwzx.gov.cn:8080/zjcs/issue/similarPaidList1.aspx?item_id=1ed1f0c7-e89f-4ace-b952-89edbf207624 http://www.wdaac.cn/zjcs/issue/similarPaidList1.aspx?item_id=1ed1f0c7-e89f-4ace-b952-89edbf207624 http://222.135.78.37:8084/zjcs/issue/similarPaidList1.aspx?item_id=1ed1f0c7-e89f-4ace-b952-89edbf207624 http://222.135.78.37:8084/zjcs/SecondPages/infodetail_YWGG.aspx?paidID=2b3f5ed2-3dcc-4c09-97ff-75073bd37be015072993745 http://www.whaac.gov.cn:8090/zjcs/SecondPages/infodetail_YWGG.aspx?paidID=2b3f5ed2-3dcc-4c09-97ff-75073bd37be015072993745 http://www.rszwfwzx.gov.cn:8080/zjcs/SecondPages/infodetail_YWGG.aspx?paidID=2b3f5ed2-3dcc-4c09-97ff-75073bd37be015072993745 http://www.wdaac.cn/zjcs/SecondPages/infodetail_YWGG.aspx?paidID=2b3f5ed2-3dcc-4c09-97ff-75073bd37be015072993745 http://222.135.78.37:8084/zjcs/SecondPages/infodetail_YWGG.aspx?paidID=2b3f5ed2-3dcc-4c09-97ff-75073bd37be015072993745 http://222.135.78.37:8084/zjcs/SecondPages/infodetail_CJXX.aspx?paidID=2b3f5ed2-3dcc-4c09-97ff-75073bd37be015072993745 http://www.whaac.gov.cn:8090/zjcs/SecondPages/infodetail_CJXX.aspx?paidID=2b3f5ed2-3dcc-4c09-97ff-75073bd37be015072993745 http://www.rszwfwzx.gov.cn:8080/zjcs/SecondPages/infodetail_CJXX.aspx?paidID=2b3f5ed2-3dcc-4c09-97ff-75073bd37be015072993745 http://www.wdaac.cn/zjcs/SecondPages/infodetail_CJXX.aspx?paidID=2b3f5ed2-3dcc-4c09-97ff-75073bd37be015072993745 http://222.135.78.37:8084/zjcs/SecondPages/infodetail_CJXX.aspx?paidID=2b3f5ed2-3dcc-4c09-97ff-75073bd37be015072993745 1处POSTSQL注入： http://www.rcsp.cn/OutNetChannel/SubItemList.aspx http://www.whaac.gov.cn:8080/OutNetChannel/SubItemList.aspx http://222.135.78.34/OutNetChannel/SubItemList.aspx http://www.cfdonline.org.cn/OutPortal_CFD/OutNetChannel/SubItemList.aspx http://www.rczw.gov.cn/OutNetChannel/SubItemList.aspx ### 漏洞证明： 注入证明： POST：http://www.rcsp.cn/OutNetChannel/SubItemList.aspx [<img src="https://images.seebug.org/upload/201508/04140426d4394b21edb39067acd16b114faa71b6.png" alt="QQ图片20150804134109.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/04140426d4394b21edb39067acd16b114faa71b6.png) [<img src="https://images.seebug.org/upload/201508/0414043573bcf2909be4f0bc798c5803ddb87d32.png" alt="QQ图片20150804134203.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/0414043573bcf2909be4f0bc798c5803ddb87d32.png) GET：http://www.whaac.gov.cn:8080/BusinessRegistration/BR_ProjectList.aspx?page=1&procode= [<img src="https://images.seebug.org/upload/201508/04140509d6b7cd4008911654d7ebc9f76bbed643.png" alt="QQ图片20150804134235.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/04140509d6b7cd4008911654d7ebc9f76bbed643.png) http://www.rcsp.cn/ViewSource/FujianDownLoad.aspx?id=1 [<img src="https://images.seebug.org/upload/201508/0414054164a04a1c947cd2ac8deb925a129c4135.png" alt="QQ图片20150804132413.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/0414054164a04a1c947cd2ac8deb925a129c4135.png) [<img src="https://images.seebug.org/upload/201508/041405511b765a634f77b4d8c0a4f8e92055d532.png" alt="QQ图片20150804132658.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201508/041405511b765a634f77b4d8c0a4f8e92055d532.png) ....其它等等都是一样。
