### 简要描述： RT ### 详细说明： 北京清大新洋科技有限公司:http://www.infosea.com.cn/ 存在注入参数:flh 看案例如下： http://211.86.195.15:8086/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://211.86.225.3:8090/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://218.241.174.148:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://61.187.55.41:8090/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://www.kflib.cn:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://lib.tongde.com:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://58.133.216.9:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://tsjs.sdwm.cn:8000/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://scsk.crsp.org.cn:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://222.27.60.13/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://tsjs.ndjclib.com:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://211.84.229.10:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://tsjs.ndjclib.com:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk 1.测试注入点:http://211.86.225.3:8090/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk [<img...
### 简要描述： RT ### 详细说明： 北京清大新洋科技有限公司:http://www.infosea.com.cn/ 存在注入参数:flh 看案例如下： http://211.86.195.15:8086/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://211.86.225.3:8090/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://218.241.174.148:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://61.187.55.41:8090/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://www.kflib.cn:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://lib.tongde.com:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://58.133.216.9:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://tsjs.sdwm.cn:8000/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://scsk.crsp.org.cn:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://222.27.60.13/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://tsjs.ndjclib.com:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://211.84.229.10:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk http://tsjs.ndjclib.com:8070/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk 1.测试注入点:http://211.86.225.3:8090/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk [<img src="https://images.seebug.org/upload/201411/30102008a7f12df28b62f838c02c13ca495e6dd5.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/30102008a7f12df28b62f838c02c13ca495e6dd5.png) 延迟好慢啊。 2.测试注入点：http://211.86.195.15:8086/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk [<img src="https://images.seebug.org/upload/201411/3010203767c099d49ea25db3aa207a71fe9401e1.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/3010203767c099d49ea25db3aa207a71fe9401e1.png) 3.测试注入点:http://lib.tongde.com:8089/opac/hot.jsp?flh=A%25&rq=7&wxlx=zyk [<img src="https://images.seebug.org/upload/201411/3010210222da03b44df39fd84a8202c4f81f8efa.png" alt="6.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/3010210222da03b44df39fd84a8202c4f81f8efa.png) 延迟很慢，我也就不一一的测试了。 ### 漏洞证明： [<img src="https://images.seebug.org/upload/201411/3010210222da03b44df39fd84a8202c4f81f8efa.png" alt="6.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/3010210222da03b44df39fd84a8202c4f81f8efa.png) [<img src="https://images.seebug.org/upload/201411/3010203767c099d49ea25db3aa207a71fe9401e1.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/3010203767c099d49ea25db3aa207a71fe9401e1.png) [<img src="https://images.seebug.org/upload/201411/30102008a7f12df28b62f838c02c13ca495e6dd5.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/30102008a7f12df28b62f838c02c13ca495e6dd5.png)
