### 简要描述： RT ### 详细说明： 吉大正元信息技术股份有限公司:http://www.jit.com.cn/ 众多政府网站都在使用该系统 我就用5个案例来测试。 注入链接是： depLayerListDir.jsp?department_id= 案例： http://zwgk.wangqing.gov.cn/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200809231048070703&department_name=乡镇（街道）政府&department_Type=0&isFirstShow= http://218.62.90.168/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200809231048070703&department_name=乡镇（街道）政府&department_Type=0&isFirstShow= http://61.138.128.150:8080/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200804031221290453&department_name=政府直属事业单位&department_Type=0&isFirstShow= http://222.34.78.21/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200804031138500843&department_name=白城市人民政府&department_Type=0&isFirstShow=是 http://218.62.67.213/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200804031221280718&department_name=政府工作部门&department_Type=0&isFirstShow=...
### 简要描述： RT ### 详细说明： 吉大正元信息技术股份有限公司:http://www.jit.com.cn/ 众多政府网站都在使用该系统 我就用5个案例来测试。 注入链接是： depLayerListDir.jsp?department_id= 案例： http://zwgk.wangqing.gov.cn/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200809231048070703&department_name=乡镇（街道）政府&department_Type=0&isFirstShow= http://218.62.90.168/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200809231048070703&department_name=乡镇（街道）政府&department_Type=0&isFirstShow= http://61.138.128.150:8080/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200804031221290453&department_name=政府直属事业单位&department_Type=0&isFirstShow= http://222.34.78.21/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200804031138500843&department_name=白城市人民政府&department_Type=0&isFirstShow=是 http://218.62.67.213/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200804031221280718&department_name=政府工作部门&department_Type=0&isFirstShow= http://222.160.175.90/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200809231048070671&department_name=政府部门和具有管理公共事务职能的组织&department_Type=0&isFirstShow= http://www.ilj.gov.cn/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200804031221280718&department_name=政府工作部门&department_Type=0&isFirstShow= http://222.162.179.83/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200804031221280718&department_name=政府工作部门&department_Type=0&isFirstShow= http://xxgk.yanji.gov.cn/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200804031221290453&department_name=各乡镇、街道&department_Type=0&isFirstShow= ### 漏洞证明： http://zwgk.wangqing.gov.cn/zwdtSjgl/Directory/depLayerListDir.jsp?department_id=DE200809231048070703&department_name=乡镇（街道）政府&department_Type=0&isFirstShow= [<img src="https://images.seebug.org/upload/201501/2210003077d0ecb9133885c4fdc2700a329d98b6.png" alt="QQ图片20150122100005.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/2210003077d0ecb9133885c4fdc2700a329d98b6.png) [<img src="https://images.seebug.org/upload/201501/22100039f0f15977d437563be4bce3cc68904a17.png" alt="QQ图片20150122100024.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/22100039f0f15977d437563be4bce3cc68904a17.png)
