### 简要描述： 合集吗 ### 详细说明： 第一个： /jcms/workflow/design/que_model.jsp 第二个： /jcms/short_message/que_recemsg.jsp 两处在一些版本里面都有越权+SQL注入。 http://www.panxian.gov.cn/jcms/workflow/design/que_model.jsp?userid= [<img src="https://images.seebug.org/upload/201406/09224016003fa99acaab2b9c74eb502fc0631761.png" alt="image009.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/09224016003fa99acaab2b9c74eb502fc0631761.png) http://www.changde.gov.cn/jcms/workflow/design/que_model.jsp?userid= [<img src="https://images.seebug.org/upload/201406/09224035784b244aaa1c4d50b5466d8e2c902162.png" alt="image011.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/09224035784b244aaa1c4d50b5466d8e2c902162.png) http://www.cshtz.gov.cn/jcms/workflow/design/que_model.jsp [<img src="https://images.seebug.org/upload/201406/092240579ffded2534b9f0978107d254bfaba8bb.png" alt="image013.png" width="600"...
### 简要描述： 合集吗 ### 详细说明： 第一个： /jcms/workflow/design/que_model.jsp 第二个： /jcms/short_message/que_recemsg.jsp 两处在一些版本里面都有越权+SQL注入。 http://www.panxian.gov.cn/jcms/workflow/design/que_model.jsp?userid= [<img src="https://images.seebug.org/upload/201406/09224016003fa99acaab2b9c74eb502fc0631761.png" alt="image009.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/09224016003fa99acaab2b9c74eb502fc0631761.png) http://www.changde.gov.cn/jcms/workflow/design/que_model.jsp?userid= [<img src="https://images.seebug.org/upload/201406/09224035784b244aaa1c4d50b5466d8e2c902162.png" alt="image011.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/09224035784b244aaa1c4d50b5466d8e2c902162.png) http://www.cshtz.gov.cn/jcms/workflow/design/que_model.jsp [<img src="https://images.seebug.org/upload/201406/092240579ffded2534b9f0978107d254bfaba8bb.png" alt="image013.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/092240579ffded2534b9f0978107d254bfaba8bb.png) http://tuoshan.yzwh.gov.cn/jcms/workflow/design/que_model.jsp [<img src="https://images.seebug.org/upload/201406/09224120206bcb671dc1cac28871bffe96909660.png" alt="image015.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/09224120206bcb671dc1cac28871bffe96909660.png) SQL： http://www.panxian.gov.cn/jcms/workflow/design/que_model.jsp?userid=&que_keywords=%E4%B8%80&que_keywords1=%E4%B8%80&que_classid=&que_classname=&b_valid=&starttime=&endtime=&sortorder=&sortnum=-1 [<img src="https://images.seebug.org/upload/201406/09224147e580bfc9beff5069e90b1cb0bbfce3f0.png" alt="image017.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/09224147e580bfc9beff5069e90b1cb0bbfce3f0.png) ### 漏洞证明： http://binjiang.zjcourt.cn:88/jcms/short_message/que_recemsg.jsp [<img src="https://images.seebug.org/upload/201406/092243577144d72c605d7dab17d72f5c2b34c60d.png" alt="image001.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/092243577144d72c605d7dab17d72f5c2b34c60d.png) http://binjiang.zjcourt.cn:88/jcms/short_message/que_recemsg.jsp?que_keywords=1&loginid=a*&que_startdate=&que_enddate= loginid存在基于时间的盲注 [<img src="https://images.seebug.org/upload/201406/0922441670947d76a62a744966bd4446806dcc79.png" alt="image003.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/0922441670947d76a62a744966bd4446806dcc79.png) 其它网站也有类似的问题： http://www.dajs.gov.cn/jcms/short_message/que_recemsg.jsp http://tuoshan.yzwh.gov.cn/jcms/short_message/que_recemsg.jsp http://www.shanting.gov.cn/jcms/short_message/que_recemsg.jsp [<img src="https://images.seebug.org/upload/201406/0922443657b41c8af506a76101dcc52418303d6a.png" alt="image005.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/0922443657b41c8af506a76101dcc52418303d6a.png)
