漏洞概要 关注数(57) 关注此漏洞
缺陷编号: WooYun-2014-67893
漏洞标题: 666个政府网站sql注入漏洞的注入点
相关厂商: 政府网站
漏洞作者: 老和尚
提交时间: 2014-07-15 14:12
公开时间: 2014-08-27 14:14
漏洞类型: SQL注射漏洞
危害等级: 高
自评Rank: 19
漏洞状态: 已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源:www.wooyun.org ,如有疑问或需要帮助请联系
Tags标签: sql注入 政府网站
漏洞详情
披露状态:
2014-07-15: 细节已通知厂商并且等待厂商处理中
2014-07-18: 厂商已经确认,细节仅向厂商公开
2014-07-28: 细节向核心白帽子及相关领域专家公开
2014-08-07: 细节向普通白帽子公开
2014-08-17: 细节向实习白帽子公开
2014-08-27: 细节向公众公开
简要描述:
666个政府网站 都有注入点, 随手看了两个,都是机密和大裤子 有的里面大马小马一句话一片一片的 希望国家互联网应急中心慢慢应急... 阿弥陀佛...
详细说明:
由于不能发太多的字, 我就不发部门了 只发注入点吧...
edu部门也挺悠闲的,过一阵我给他们找点活干...
一行一个注入点 一个注入点代表一个网站, 我通过excel 去重了
如果你喜欢指哪补哪 联系我Q 12151915 我把所有注入点都发给你.
http://**.**.**.**/News.asp?Bigid=30
http://**.**.**.**/aspx/online.aspx?onlineID=4
http://**.**.**.**/news.php?id=950
http://**.**.**.**/brow.asp?classid=4
http://**.**.**.**/ucms/cms/webapp/column.jsp?ColumnID=1342
http://**.**.**.**/news/bgshow.asp?id=83
http://**.**.**.**/News.asp?classid=78
http://**.**.**.**/news_view.asp?newsid=216
http://**.**.**.**/Article/?Type=18
http://**.**.**.**/about_view.aspx?id=1651
http://**.**.**.**/sub2_BGXZ.aspx?id=4
http://**.**.**.**/group2.php?GroupID=1723
http://**.**.**.**/getlist.asp?pmid=101&fmid=102
http://**.**.**.**/news.php?typeid=159
http://**.**.**.**/hsxwsp/index.asp?id=1717
http://**.**.**.**/gyfwcla.asp?id=10
http://**.**.**.**/newsview.asp?id=158
http://**.**.**.**/view.asp?id=1535&cid=244
http://**.**.**.**/class.asp?id=296&classId=295
http://**.**.**.**/SpecialPage/index.aspx?url_pid=174&cateid=360
http://**.**.**.**/E_ReadOpinion.asp?OpinionID=763
http://**.**.**.**/pinglun3_alldis.php?yitiid=21
http://**.**.**.**/search.jsp?title_content=all&keyword=
http://**.**.**.**/info.php?left=1&cat_pid=67
http://**.**.**.**/more.aspx?sid=0107
http://**.**.**.**/kf/msg.asp?id=33
http://**.**.**.**/q_flfw.asp?lm_id=1023
http://**.**.**.**/sxyx/changhang.aspx?id=19339
http://**.**.**.**/template/default/newslist.jsp?classId=8a22804434c19b5f0134d0bdb4b0002a
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/article.php?MsgId=91231
http://**.**.**.**/nsrxx/list/spbf.do?b_spbf=true&spid=27
http://**.**.**.**/readnews.asp?id=4213
http://**.**.**.**/news_more.asp?lm=73
http://**.**.**.**/search.jsp?title_content=all&keyword=
http://**.**.**.**/hyzsxi.php?id=519
http://**.**.**.**/cjwtlist.aspx?t=1
http://**.**.**.**/openxw.asp?id=41041
http://**.**.**.**/newlist.php?id=5
http://**.**.**.**/article_show_mdgk.asp?articleid=24215
http://**.**.**.**/newsshow.asp?id=(799)
http://**.**.**.**/type.asp?ID=1
http://**.**.**.**/bljh_1.aspx?id=102
http://**.**.**.**/oldjjw/3.asp?id=69
http://**.**.**.**/xwy.asp?wb=1&bh=937
http://**.**.**.**/Information/Information_View.aspx?Contentid=8498
http://**.**.**.**/web/cwhgk.asp?LMid=25
http://**.**.**.**/e_lmwz_list.jsp?colid1=2&colid2=37
http://**.**.**.**/mytc/showmytc.asp?id=112
http://**.**.**.**/hdpd/myzj/myzjadd.jsp?id=672
http://**.**.**.**/?mod=index&act=article&doing=list&cid=2
http://**.**.**.**/bsznShow.aspx?NewsId=77
http://**.**.**.**/source/list/qzzy_list.asp?id=4
http://**.**.**.**/include/web_content.php?id=446
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/CongYeZhuTiXianShi.aspx?ID=20
http://**.**.**.**/Zxdt.Asp?cid=2
http://**.**.**.**/Vote.aspx?Id=8
http://**.**.**.**/index_list.aspx?id=60
http://**.**.**.**/infodisp.asp?id=615
http://**.**.**.**/dstz/bbjsxs1.asp?id=24
http://**.**.**.**/jcdj_show.asp?newsid=64
http://**.**.**.**/news/view.asp?id=3630
http://**.**.**.**/jcdtView.jsp?id=580
http://**.**.**.**/jgjj.asp?id=398
http://**.**.**.**/newlist.php?id=24
http://**.**.**.**/chief/index.php?ty=182
http://**.**.**.**/TopicManage/Qzlx/List.aspx?Type_ID=46
http://**.**.**.**/lzwh/imagesview.asp?P_ID=611
http://**.**.**.**/Articleshow.asp?id=772
http://**.**.**.**/YTIICSMDH/show.jsp?id=230524
http://**.**.**.**/index.jsp?urltype=tree.TreeTempUrl&wbtreeid=10504
http://**.**.**.**/167jtcontent.aspx?ArticleID=781
http://**.**.**.**/show/showarticle.asp?ID=770
http://**.**.**.**/lyny.php?id=21
http://**.**.**.**/zwgk/info.aspx?id=1594
http://**.**.**.**/content.do?method=sendTo&cid=106
http://**.**.**.**/leader.jsp?classid=23
http://**.**.**.**/list.asp?type=2&c=20107895055150
http://**.**.**.**/information.jsp?xmid=2034
http://**.**.**.**/content/?id=189
http://**.**.**.**/zxnr.asp?classid=1&id=5940
http://**.**.**.**/wz.asp?id=134
http://**.**.**.**/agency.asp?ids=8
http://**.**.**.**/list.aspx?id=79
http://**.**.**.**/search.jsp?keyword=
http://**.**.**.**/yxwz/yxwz_list.php?type=1
http://**.**.**.**/?ctl=index&act=list&category_code=67108864
http://**.**.**.**/list/index.php?zlm=1
http://**.**.**.**/datalist.asp?Mitem=1
http://**.**.**.**/jigou.php?id=42
http://**.**.**.**/alistclass.asp?id=1
http://**.**.**.**/PowerInfor.aspx?Id=1
http://**.**.**.**/class_2.asp?classid=40&newsid=498
http://**.**.**.**/Mlty.php?classid=7
http://**.**.**.**/tmp/wzpm.shtml?show=list&UI_ID=2
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/UpFile/template/firstpage/wjtyw_current/TywWebMessage.aspx?xftype=3
http://**.**.**.**/list_tp.asp?sort_id=578
http://**.**.**.**/GPI/index.aspx?dept=92338301
http://**.**.**.**/newsDetail.aspx?id=17125
http://**.**.**.**/Article_Class.asp?ClassID=44
http://**.**.**.**/article.php?MsgId=91430
http://**.**.**.**/Page/zw_jzxx_Content.aspx?id=2779
http://**.**.**.**/zt_xjhd/zt.asp?bigfeatureid=20
http://**.**.**.**/page/col1_lb.php?lbid=657
http://**.**.**.**/index/detail.aspx?id=68
http://**.**.**.**/content/info.php?Pid=1&ty=2
http://**.**.**.**/detailP.aspx?id=2254
http://**.**.**.**/zixun_detail.jsp?id=424
http://**.**.**.**/ysqgkzzjg.jsp?urltype=tree.TreeTempUrl&wbtreeid=18341
http://**.**.**.**/ShowNews.asp?id=5563
http://**.**.**.**/newslist.asp?id=14
http://**.**.**.**/list.asp?type=2&c=20107895055150
http://**.**.**.**/detail.asp?type=policy&id=179
http://**.**.**.**/onews.asp?id=2468
http://**.**.**.**/list.aspx?cid=1
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/Search.html?Q=%E9%99%88%E9%B8%A3%E6%98%8E
http://**.**.**.**/ArticleContent.asp?ID=212
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/nzcms_list_news.asp?id=743&sort_id=657
http://**.**.**.**/about_list.aspx?id=5&oid=1
http://**.**.**.**/list.aspx?id=1
http://**.**.**.**/ecms/IndexServlet?siteID=2&nodeID=55010
http://**.**.**.**/article.php?MsgId=91428
http://**.**.**.**/bbs/rss.php?auth=0
http://**.**.**.**/about.php?id=1
http://**.**.**.**/onews.asp?id=1231
http://**.**.**.**/pwsjxx/xj_xx.asp?id=900
http://**.**.**.**/cj.aspx?id=8
http://**.**.**.**/sundun/zx_show.aspx?id=110617
http://**.**.**.**/hudong_show.asp?id=5278
http://**.**.**.**/Browse/InfoD.aspx?Board=1801
http://**.**.**.**/mail.aspx?type=2
http://**.**.**.**/ask_show.asp?id=363
http://**.**.**.**/showdown.asp?soft_id=145
http://**.**.**.**/meitifangtan_lb.asp?id=75
http://**.**.**.**/shownews.asp?id=520
http://**.**.**.**/platform/showClass.aspx?ClassID=8
http://**.**.**.**/zthd.asp?class_id=30
http://**.**.**.**/content.asp?lclass_ID=83&id=17366
http://**.**.**.**/View_1.asp?id=3476
http://**.**.**.**/183.asp?classid=84
http://**.**.**.**/search.jsp?title_content=all&keyword=
http://**.**.**.**/ClassInfo2.asp?PrdID=95
http://**.**.**.**/jhygh/index.php?dir=/%E7%A7%91%E6%8A%80%E8%A7%84%E5%88%92%E4%B8%8E%E8%AE%A1%E5%88%92/%E7%A7%91%E6%8A%80%E8%A7%84%E5%88%92
http://**.**.**.**/BigClass.asp?C_typeid=8&C_BigClassID=44
http://**.**.**.**/news_show.aspx?id=2084
http://**.**.**.**/Article.aspx?CategoryId=34
http://**.**.**.**/list.asp?cataid=7
http://**.**.**.**/forum/rss.php?auth=0
http://**.**.**.**/Nav_xxgklist.asp?SS_ID=7363
http://**.**.**.**/bsljd/bihai/shownews.asp?id=4225
http://**.**.**.**/cjwtview.asp?id=58
http://**.**.**.**/content.jsp?danwei=43&fenlei=7200&nian=2014-01-01&liushui=744
http://**.**.**.**/work/search.jsp?keyWord=
http://**.**.**.**/n_v_page2014.asp?smallname=%E6%B3%95%E6%B2%BB%E5%85%B4%E5%B9%B3%E8%8A%82%E7%9B%AE%E8%A7%86%E9%A2%91&smallid=86
http://**.**.**.**/listshow.asp?fid=2
http://**.**.**.**/NewsShow.asp?ListId=65979
http://**.**.**.**/zcfg/detail_info.asp?id=1204
http://**.**.**.**/ShowNews.asp?id=1029
http://**.**.**.**/zz.asp?id=15
http://**.**.**.**/hzjzw/index.asp?P=1
http://**.**.**.**/lookarticle.asp?articleid=266
http://**.**.**.**/news2.asp?classid=7
http://**.**.**.**/listall.aspx?ID=36
http://**.**.**.**/inc/shownews.asp?id=1517
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/info/index.asp?id=1
http://**.**.**.**/difangdongtai/news.asp?dm=9166
http://**.**.**.**/jzxx/jzxx_view.php?id=1387027915
http://**.**.**.**/show.php?id=327
http://**.**.**.**/showxiangmu10.asp?art_id=117
http://**.**.**.**/Enterprise_List.asp?AgencyID=1
http://**.**.**.**/GPI/index.aspx?dept=92338200
http://**.**.**.**/show.aspx?id=1536
http://**.**.**.**/newlist.php?id=17
http://**.**.**.**/lyb2/gzbg_login_new.asp?name=6
http://**.**.**.**/readnews.php?class=%E6%A0%87%E9%A2%98%E6%A0%8F&subclass=%E6%96%87%E4%BB%B6%E9%80%9A%E7%9F%A5&id=227
http://**.**.**.**/wlcbsearch.jsp?title_content=all&keyword=
http://**.**.**.**/y/Showclass.asp?classID=
http://**.**.**.**/show.asp?id1=71
http://**.**.**.**/list_news.asp?id=590&sort_id=586
http://**.**.**.**/q_jjgk.asp?lm_id=1040
http://**.**.**.**/price_list.do?orgid=23
http://**.**.**.**/message.aspx?id=0
http://**.**.**.**/xinxi/news_view.asp?newsid=19
http://**.**.**.**/wsba/public/Company/CompanyInfo.aspx?code=1112
http://**.**.**.**/details.asp?id=536
http://**.**.**.**/newsDetail.asp?id=1094
http://**.**.**.**/news.asp?typeid=38
http://**.**.**.**/picnew.asp?ID=385
http://**.**.**.**/news_more.asp?lm=73
http://**.**.**.**/content.jsp?danwei=43&fenlei=7200&nian=2014-01-01&liushui=744
http://**.**.**.**/news.php?id=132
http://**.**.**.**/cms/article.php?articleId=61
http://**.**.**.**/body.asp?ID=6361
http://**.**.**.**/BulletinShow.aspx?cid=51
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/gcjs/List.aspx?id=108
http://**.**.**.**/onlineshow.jsp?val_id=30102
http://**.**.**.**/mlzj.asp?classid=14
http://**.**.**.**/xxzx/infodetail.asp?Catalog=%5C%E6%96%B0%E9%97%BB%E5%8A%A8%E6%80%81%5C%E6%96%B0%E9%97%BB%E5%8A%A8%E6%80%81%5C&Mov_ID=8981
http://**.**.**.**/GPI/index.aspx?dept=92339112
http://**.**.**.**/course/show?id=32
http://**.**.**.**/news.asp?board=71
http://**.**.**.**/About.asp?ID=20
http://**.**.**.**/Dj.asp?cat_id=1
http://**.**.**.**/article.php?MsgId=91265
http://**.**.**.**/article.php?MsgId=89375
http://**.**.**.**/article.php?MsgId=91542
http://**.**.**.**/ksclass.asp?ksid=31
http://**.**.**.**/zf11_news2.asp?id=23
http://**.**.**.**/news/newsmore.aspx?lid=89
http://**.**.**.**/Nav_hudongjiaoliu_yldc0.asp?SS_ID=1087
http://www.**.**.**.**/tmp/wzpm.shtml?show=list&UI_ID=2
http://**.**.**.**/hd/zxtx_show.asp?sid=110
http://**.**.**.**/InfoList.php?S=1
http://**.**.**.**/KXDT.aspx?y=2011
http://**.**.**.**/html/Home/folder/13120334-1.htm?id=212
http://**.**.**.**/show.asp?id=50
http://**.**.**.**/list.jsp?typeid=58
http://**.**.**.**/clsz.jsp?pxh=18&progbh=18&axh=2
http://**.**.**.**/cms/article.php?articleId=61
http://**.**.**.**/cjcyxcs.asp?id=78
http://**.**.**.**/pic.asp?cat_id=16
http://**.**.**.**/Videos.aspx?ID=123
http://**.**.**.**/new.asp?big=ldjh&small=ldjh&ID=569
http://**.**.**.**/index.jsp?urltype=tree.TreeTempUrl&wbtreeid=1001
http://**.**.**.**/ArticleDetail.aspx?i=1942
http://**.**.**.**/about.php?class=4
http://**.**.**.**/list.asp?lm=28
http://**.**.**.**/news.asp?board=71
http://**.**.**.**/zttj_more.asp?ztid=11
http://**.**.**.**/wz.asp?id=24
http://**.**.**.**/showClassify/default.aspx?TypeId=101
http://**.**.**.**/cgzs-jpgc1.php?channel_id=91
http://**.**.**.**/article.asp?lbid=1
http://**.**.**.**/info/infodetail.aspx?id=129857
http://**.**.**.**/list-childsite.aspx?cid=10&oid=2
http://**.**.**.**/zwgk/hf.php?lx=0
http://**.**.**.**/showall.asp?glbm=070280989
http://**.**.**.**/list.aspx?tid=3
http://**.**.**.**/xsnr.asp?id=1156
http://**.**.**.**/popbase.asp?class_id=12&id=621
http://**.**.**.**/news_show.asp?id=1137
http://**.**.**.**/content.do?method=sendTo&cid=106
http://**.**.**.**/dwxinxi.aspx?id=180
http://**.**.**.**/nzcms_list_news.asp?id=709&sort_id=656
http://**.**.**.**/cjs/bx2.aspx?id=313
http://**.**.**.**/bzmail/display.asp?id=590
http://**.**.**.**/tzggdetail.asp?id=17
http://**.**.**.**/show_news.asp?id=2807
http://**.**.**.**/hudong_show.asp?id=788
http://**.**.**.**/article.php?MsgId=90652
http://**.**.**.**/list.asp?ID=127
http://**.**.**.**/xzxk/xzxk_detail.asp?id=416
http://**.**.**.**/list.aspx?i=1
http://**.**.**.**/webui/Article_content.aspx?CID=4723
http://**.**.**.**/html/?m_id=273
http://**.**.**.**/xzqlyxgkMore.aspx?bsflID=5
http://**.**.**.**/fuwuview.asp?SortID=2&ID=474
http://**.**.**.**/law.asp?classid=68
http://**.**.**.**/zhengfu/news1.asp?id=322
http://**.**.**.**/seenews_info.asp?newsid=383
http://**.**.**.**/news_more.asp?lm=17
http://**.**.**.**/down.php?Id=663
http://**.**.**.**/display.asp?classid=6
http://**.**.**.**/brow.asp?classid=38
http://**.**.**.**/zhuantilist.asp?topicId=37
http://**.**.**.**/art.php?classid=1
http://**.**.**.**/news.php?id=452
http://**.**.**.**/detail.asp?newsid=4285
http://**.**.**.**/ggny/Show.aspx?id=68
http://**.**.**.**/dangjian-disc.asp?id=5563
http://**.**.**.**/sjxx.asp?id=24
http://**.**.**.**/GPI/index.aspx?dept=92337927
http://**.**.**.**/110/zxbr.aspx?id=2014627115330
http://**.**.**.**/about.asp?classID=1
http://**.**.**.**/list.aspx?cid=1
http://**.**.**.**/louitems.aspx?itemid=175&deptid=175
http://**.**.**.**/about_view.aspx?id=27124
http://**.**.**.**/Articleshow.asp?id=1878
http://**.**.**.**/viewpub.asp?id=3
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/rmjdy.asp?SS_ID=119
http://**.**.**.**/sitevote/Cycoo_VoteView.asp?ID=3
http://**.**.**.**/clist.jsp?id=1453
http://**.**.**.**/ClassInfo.asp?PrdID=58
http://**.**.**.**/xwzxxxy.aspx?tid=10660&txtID=224
http://**.**.**.**/zizhan/index.php?cid=211
http://**.**.**.**/system/sys0_Message_show.asp?m_ID=4429
http://**.**.**.**/main.asp?id=1
http://**.**.**.**/Tmp/Nav_lingdaozhichuang.shtml?class=1
http://**.**.**.**/sitecn/minfo.aspx?id=300
http://**.**.**.**/news.asp?SmallClassID=7&BigClassID=16
http://**.**.**.**/news_more.asp?lm2=286
http://**.**.**.**/fcjlc/content.aspx?id=1609
http://**.**.**.**/ShowNews.asp?id=493
http://**.**.**.**/OnlineSurvey/Sub/?T=4
http://**.**.**.**/detail.php?id=22
http://**.**.**.**/default.php?mod=article&settype=0&fid=2255
http://**.**.**.**/zxjg.jsp?typeId=390
http://**.**.**.**/nzcms_list.asp?sort_id=706
http://**.**.**.**/jjxw_list.asp?c_id=196
http://**.**.**.**/culture.asp?owner=0
http://**.**.**.**/lecture_fortell.asp?classname=%E8%AE%B2%E5%BA%A7%E9%A2%84%E5%91%8A&id=1116
http://**.**.**.**/cun/c_index.asp?tid=667
http://**.**.**.**/adqicai/read.asp?id=253
http://**.**.**.**/ConInfoParticular.jsp?id=9504
http://**.**.**.**/List_FGNews.asp?Sorts=34
http://**.**.**.**/xc.asp?id=3
http://**.**.**.**/index.jsp?wbtreeid=1001
http://**.**.**.**/LS_show.asp?id=2071
http://**.**.**.**/display.asp?id=2420&second_id=2001&base_id=2
http://**.**.**.**/interview/list.jsp?status=2
http://**.**.**.**/list.asp?newsid=5346
http://**.**.**.**/X_ReadNews.asp?NewsID=617
http://**.**.**.**/news/default.asp?cataid=12
http://**.**.**.**/nzcms_list_news.asp?id=670&sort_id=657
http://**.**.**.**/news_xwsd.asp?ClassID=14
http://**.**.**.**/wz.asp?id=499
http://**.**.**.**/wz_show.asp?NewsId=5050
http://**.**.**.**/Text.Asp?SortId=65
http://**.**.**.**/more.asp?Nclass_Id=1
http://**.**.**.**/rss.php?auth=0
http://**.**.**.**/aboutus/webnewslist.asp?typeid=9
http://**.**.**.**/fgzd.php?id=1
http://**.**.**.**/showabout.asp?cid=4107
http://**.**.**.**/zwgk/hf.php?lx=0
http://**.**.**.**/erji.jsp?flm=23&fname=%E6%9C%8D%E5%8A%A1%E6%8C%87%E5%8D%97&zname=%E4%B8%BA%E4%BE%A8%E6%9C%8D%E5%8A%A1%E6%8C%87%E5%8D%97&fid=4
http://**.**.**.**/zxgg_Pop.asp?id=291
http://**.**.**.**/news.php?typeid=159
http://**.**.**.**/jzmhznr.asp?ArticleID=19
http://**.**.**.**/wsbs_list.aspx?classid=1&type=100
http://**.**.**.**/wz.asp?id=2
http://**.**.**.**/xzxx.php?classid=211&id=1464
http://**.**.**.**/qzlx/cpspzb.php?sid=4
http://**.**.**.**/cn/wz.asp?id=910
http://**.**.**.**/info_show.asp?sysid=2027
http://**.**.**.**/zmhd.asp?id=10
http://**.**.**.**/jj_content_type.asp?jj_title_type=1
http://**.**.**.**/Fxzt.asp?ClassID=253
http://**.**.**.**/news_more.jsp?lm=18
http://**.**.**.**/class.asp?id=61
http://**.**.**.**/ldxx.asp?cn=100338&id=11213
http://**.**.**.**/GPI/index.aspx?dept=92337928
http://**.**.**.**/jiandu/list.asp?id=1
http://**.**.**.**/articledisp.aspx?infoid=3373
http://**.**.**.**/content.jsp?danwei=43&fenlei=7200&nian=2014-01-01&liushui=810
http://**.**.**.**/zjbl.aspx?lmid=323
http://**.**.**.**/view.asp?id=1675
http://**.**.**.**/class.php?class=1
http://**.**.**.**/newsview.asp?id=1009
http://**.**.**.**/list.jsp?id=330
http://**.**.**.**/more.asp?NClass_Id=14
http://**.**.**.**/Body.asp?ID=13232
http://**.**.**.**/comment.asp?classid=1
http://**.**.**.**/info/index.asp?id=1
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/news/view.asp?id=458
http://**.**.**.**/xs.asp?id=6864&name=%20%E5%A4%B4%E6%9D%A1&sort_id=419
http://**.**.**.**/Info_List.aspx?C=2
http://**.**.**.**/department/show/showgovfile.asp?id=318
http://**.**.**.**/about.asp?id=37
http://**.**.**.**/NewDetail.asp?webBaseId=25&lgflag=CN&webSiteId=159&articleId=23440
http://**.**.**.**/NewsFront_List.aspx?id=3
http://**.**.**.**/list.aspx?cid=2
http://**.**.**.**/index.jsp?wbtreeid=1001
http://**.**.**.**/xjxs.asp?id=14839
http://**.**.**.**/article.php?MsgId=91126
http://**.**.**.**/about.aspx?dlei=54&xlei=95
http://**.**.**.**/wz.asp?id=401
http://**.**.**.**/lyb/lybview.aspx?id=24
http://**.**.**.**/gbzfjs.jsp?parid=55
http://**.**.**.**/infoList.aspx?ColId=128&SecId=132
http://**.**.**.**/html/news-1.php?id=5775
http://**.**.**.**/BigClass.asp?typeid=21&BigClassID=71
http://**.**.**.**/Class.asp?PrdID=10
http://**.**.**.**/xuanchuanyingxiao/shipin.asp?id=61
http://**.**.**.**/gongqiu.jsp?sid=6201
http://www.**.**.**.**/cms/article.php?articleId=61
http://**.**.**.**/Article/ShowClass.asp?ClassID=1
http://**.**.**.**/CommonList.asp?cid=60
http://**.**.**.**/rc/com_job_list.asp?id=1033&com_id=284
http://**.**.**.**/default.php?mod=article&settype=0&fid=1538
http://**.**.**.**/tpxw.asp?id=563
http://**.**.**.**/pic/album.jsp?albumType=1
http://**.**.**.**/show.asp?Id=334
http://**.**.**.**/read.php?id=1015
http://**.**.**.**/ac.asp?classid=16
http://**.**.**.**/onews.asp?id=213
http://**.**.**.**/qyfc.asp?id=57
http://**.**.**.**/Article_Sort.asp?Sort=1
http://**.**.**.**/newsview.asp?id=1694
http://**.**.**.**/news.asp?tp=162
http://**.**.**.**/news/news_list.asp?typeid=42
http://**.**.**.**/swm/publish/look.asp?id=857015
http://**.**.**.**/list.asp?lm=11
http://**.**.**.**/mx2.asp?id=2420
http://**.**.**.**/nzcms_list_news.asp?id=709&sort_id=656
http://**.**.**.**/article.php?MsgId=91080
http://**.**.**.**/About.asp?ID=26
http://**.**.**.**/map.asp?ID=28&SortID=41&SortPath=0,14,41,
http://**.**.**.**/YTIICSMDH/show.jsp?id=231155
http://**.**.**.**/dgtwenjian.asp?articleid=96
http://**.**.**.**/CeshiView.asp?id=5
http://**.**.**.**/wz.asp?id=732
http://**.**.**.**/Nav_hudongjiaoliu_yldc.asp?SS_ID=334&VoteID=124
http://**.**.**.**/gjfg_nei.asp?n_id=733
http://**.**.**.**/dangjian/djdt.php?rid=21
http://**.**.**.**/Plugin/huisinvote/DynamicWeb.aspx?voteID=25
http://**.**.**.**/Plugin/huisinvote/DynamicWeb.aspx?voteID=25
http://**.**.**.**/list.jsp?id=3662
http://**.**.**.**/sec_class.php?tid=5
http://**.**.**.**/list.asp?id=671
http://**.**.**.**/myztc_show.php?id=2635
http://**.**.**.**/zhengshudetails.asp?id=187
http://**.**.**.**/ShowNews.asp?id=1007
http://**.**.**.**/yggc/NewsList.asp?SortID=9
http://**.**.**.**/ENT.asp?act=16
http://**.**.**.**/newsshow.asp?ArticleID=3382
http://**.**.**.**/CeshiView.asp?id=25
http://**.**.**.**/net/xxgk/zwList.aspx?cid=87
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/MoralsView.asp?id=14
http://**.**.**.**/CeshiView.asp?id=8
http://**.**.**.**/cpws/content.asp?cpws_id=16
http://**.**.**.**/content.asp?articleid=4444&classid=1
http://**.**.**.**/nsr_lsqkfk_read.asp?id=13
http://**.**.**.**/CeshiView.asp?id=8
http://**.**.**.**/gzhd/zxft/news_show.asp?id=598
http://**.**.**.**/zixun.aspx?id=3
http://**.**.**.**/contentview.asp?sortid=2&id=2389
http://**.**.**.**/hjjc2.asp?id=1
http://**.**.**.**/more.asp?lm=389
http://**.**.**.**/gk_2011/showld.asp?typeid=8
http://**.**.**.**/tp/vote.asp?q=12
http://**.**.**.**/chdw_view.asp?id=63
http://**.**.**.**/CeshiView.asp?id=10
http://**.**.**.**/guestbook/?id=2
http://**.**.**.**/article.asp?class=8
http://**.**.**.**/CeshiView.asp?id=8
http://**.**.**.**/news_more.asp?lm2=85
http://**.**.**.**/detail.asp?id=529
http://**.**.**.**/default.php?mod=article&settype=0&fid=2540
http://**.**.**.**/jsp/wsdc/wsdcCxt.jsp?sid=3
http://**.**.**.**/tongjizhongxin/ShowArticle.asp?ArticleID=1828
http://**.**.**.**/list.asp?sort_id=657
http://**.**.**.**/classinfo.asp?class=134
http://**.**.**.**/article.php?MsgId=82289
http://**.**.**.**/qy/guest_show.asp?id=22
http://**.**.**.**/brow.asp?classid=20
http://**.**.**.**/Soft_Class.asp?ClassID=6
http://**.**.**.**/nzcms_show_news.asp?id=5861
http://**.**.**.**/forDev/ysz.php?pid=5554
http://**.**.**.**/pages/book/book_show.jsp?id=79
http://**.**.**.**/movie.asp?cat_id=3
http://**.**.**.**/detail.aspx?NewsID=4470
http://**.**.**.**/MoralsView.asp?id=12
http://**.**.**.**/tu_ll.asp?id=43
http://**.**.**.**/news.aspx?id=10630
http://**.**.**.**/DispText.aspx?id=6715&subClassID=15
http://**.**.**.**/zw/shownews.asp?newsid=1841
http://**.**.**.**/news3.aspx?nid=9
http://**.**.**.**/about.asp?bigid=8
http://**.**.**.**/Eventsshow.asp?ID=448
http://**.**.**.**/newlist.php?type=1
http://**.**.**.**/show.aspx?id=534
http://**.**.**.**/news/catalogdetail.asp?catalog_id=5
http://**.**.**.**/gjj/news.asp?id=41
http://**.**.**.**/news_view.aspx?id=15525
http://**.**.**.**/CeshiView.asp?id=4
http://**.**.**.**/dialog.asp?ID=3789
http://**.**.**.**/MoreFrist.asp?BID=3&SID=27
http://**.**.**.**/Data/Data_list.aspx?trans_chdchannel_id=3
http://**.**.**.**/info.jsp?id=1724
http://**.**.**.**/articleshow.asp?id=810
http://**.**.**.**/more.asp?nClass_Id=1
http://**.**.**.**/GuestBookNr.asp?GuestId=3936
http://**.**.**.**/wz.asp?id=247
http://**.**.**.**/CeshiView.asp?id=15
http://**.**.**.**/toupiao/show.asp?id=6
http://**.**.**.**/List.Asp?Id=12
http://**.**.**.**/net/xxgk/zwList.aspx?cid=87
http://**.**.**.**/newscontent.asp?lsh=886
http://**.**.**.**/rdfk/shownews.asp?newsid=1262
http://**.**.**.**/bbs/forum.php?mod=forumdisplay&fid=2
http://**.**.**.**/Body.asp?ID=55
http://**.**.**.**/detail.asp?xw_id=1506
http://**.**.**.**/default.php?mod=article&settype=0&fid=2443
http://**.**.**.**/default.php?mod=article&settype=0&fid=1416
http://**.**.**.**/doc/guestbook/index.php?type=1
http://**.**.**.**/news_info/list.asp?sort_id=14
http://**.**.**.**/read.asp?id=479
http://**.**.**.**/show.asp?id=13
http://**.**.**.**/website/showContent.jsp?_nid=1552
http://**.**.**.**/onews.asp?id=543
http://**.**.**.**/expert_view.asp?expertid=356
http://**.**.**.**/newslist.php?column_fid=23
http://**.**.**.**/nzcms_list_news.asp?id=665&sort_id=656
http://**.**.**.**/change_view.asp?id=1235
http://**.**.**.**/nzcms_list_news.asp?id=590&sort_id=586
http://**.**.**.**/type.asp?ID=12
http://**.**.**.**/asp/detail.asp?id=33388
http://**.**.**.**/20140320/List.asp?ColumnId=237
http://**.**.**.**/MoralsView.asp?id=14
http://**.**.**.**/ConInfoParticular.jsp?id=6278
http://**.**.**.**/shizheng.asp?kind=%E6%97%B6%E6%94%BF%E6%96%B0%E9%97%BB&id=12373
http://**.**.**.**/display.asp?id=1905&second_id=1007&base_id=1
http://**.**.**.**/default.php?mod=article&settype=0&fid=2662
http://**.**.**.**/zwgk/hf.php?lx=0
http://**.**.**.**/newsView.asp?Id=54
http://**.**.**.**/root/hyfc/ShowContent.asp?id=1248
http://**.**.**.**/ShowNews.asp?id=584
http://**.**.**.**/newsdetail.asp?nodecode=00080001&id=1476
http://**.**.**.**/YTIICSMDH/show.jsp?id=230524
http://**.**.**.**/djinfo.asp?id=724
http://**.**.**.**/show.aspx?id=1215
http://**.**.**.**/wzphoto.asp?id=10768
http://**.**.**.**/ghggMore.aspx?channel_id=42&category_id=278
http://**.**.**.**/bszn.asp?ClassID=8
http://**.**.**.**/SupplyAndDemandInfo/InfoPublic.aspx?MenuType=183&Type=188&ParentID=182
http://**.**.**.**/default.php?mod=article&settype=0&fid=2647
http://**.**.**.**/MoralsView.asp?id=16
http://**.**.**.**/web/download_1.asp?fname=%E8%A1%A8%E6%A0%BC%E8%B5%84%E6%96%99&fid=2
http://**.**.**.**/bjss/nr.asp?id=22102
http://**.**.**.**/show_news.asp?id=1919
http://**.**.**.**/xxmore.asp?classid=1
http://**.**.**.**/CeshiView.asp?id=30
http://**.**.**.**/content.asp?id=3
http://**.**.**.**/news_view.Asp?id=86
http://**.**.**.**/CeshiView.asp?id=9
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/class.asp?class_id=92
http://**.**.**.**/aqscy_m.jsp?typeid=1519
http://**.**.**.**/tmp/Nav_lingdaozhichuang.shtml?SS_ID=107&stype=1
http://**.**.**.**/gsdt_show.asp?action=news&class_code=101&id=1469
http://**.**.**.**/zhifa_1.asp?id=15818
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/down_show.asp?id=62
http://**.**.**.**/vote/show.asp?VoteID=4
http://**.**.**.**/Text.Asp?SortId=65
http://**.**.**.**/smalllist.asp?smallclassid=182
http://**.**.**.**/ShowInfo.asp?ID=6211
http://**.**.**.**/ConInfoParticular.jsp?id=18040
http://**.**.**.**/about.asp?smallclassid=317
http://**.**.**.**/page/news_detail.jsp?NewsSort=3&NEWSID=877
http://**.**.**.**/news2.asp?lm2id=210
http://**.**.**.**/newsmore.aspx?classid=1
http://**.**.**.**/sortMark.aspx?id=01
http://**.**.**.**/type.asp?ID=1
http://**.**.**.**/e/tool/gbook/index1sly.php?lyid=1713
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/cxxt/zcsbxx.asp?id=673
http://**.**.**.**/showdetail.jsp?pxh=31&progbh=1203&axh=1
http://**.**.**.**/news.asp?classid=47
http://**.**.**.**/Article_Class2.asp?ClassID=5
http://**.**.**.**/newslist.jsp?lmid=76
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/ShowNews.asp?id=3112
http://**.**.**.**/Article/ShowArticle.asp?ArticleID=29231
http://www.**.**.**.**/nzcms_list_news.asp?id=665&sort_id=656
http://**.**.**.**/list.aspx?id=70
http://**.**.**.**/2011e/E_ReadOpinion.asp?OpinionID=10
http://**.**.**.**/videolist.aspx?columnid=140
http://**.**.**.**/class.asp?ClassID=16
http://**.**.**.**/Page/ListPage.aspx?ListID=16335&ModuleID=364
http://**.**.**.**/news_detail.php?cid=1&id=664
http://**.**.**.**/news_more.asp?lm=&lm2=75
http://**.**.**.**/Show.asp?id=3075
http://**.**.**.**/list.asp?cid=33
http://**.**.**.**/infolist.asp?sortid=1
http://**.**.**.**/newlist.php?id=5
http://**.**.**.**/hjjc2.asp?id=1
http://**.**.**.**/newslist.aspx?news_type=7
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/CeshiView.asp?id=10
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/news/news_more.asp?lm=82
http://**.**.**.**/work_area.asp?big_id=1
http://**.**.**.**/CeshiView.asp?id=9
http://**.**.**.**/default.php?mod=article&settype=0&fid=2949
http://**.**.**.**/article.asp?id=1961
http://**.**.**.**/default.php?mod=article&settype=0&fid=1548
http://**.**.**.**/news_more.asp?lm2=93
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/announcelist_c.aspx?type=91
http://**.**.**.**/jianbaoshow.asp?id=1640
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/view.asp?keyno=4177
http://**.**.**.**/newslist.asp?typeid=109&bigclassid=193
http://**.**.**.**/index2_show.asp?ID=2618
http://**.**.**.**/view.asp?keyno=2311
http://**.**.**.**/companyt.php?cid=1
http://**.**.**.**/cmsapp/survey/product/showsurvey.jsp?id=34
http://**.**.**.**/news/newindex.aspx?maxtype=67
http://**.**.**.**/view.asp?keyno=3461
http://**.**.**.**/ShowNews.asp?id=1665
http://**.**.**.**/shownews.asp?id=41
http://**.**.**.**/list.asp?btype=%D0%C2%CE%C5%B6%AF%CC%AC&ctype=2
http://**.**.**.**/show.aspx?id=10596
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/gknb.php?menuid=222
http://**.**.**.**/showdiaocha.aspx?dcid=3
http://**.**.**.**/news_05.php?tid=1
http://**.**.**.**/page.asp?classid=1
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/zhuanti/content.asp?id=69
http://**.**.**.**/news_more.asp?lm2=316
http://**.**.**.**/aspx/gqxx.aspx?gqtype=0
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/gaikuang.php?id=1
http://**.**.**.**/show.php?id=50
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/CeshiView.asp?id=32
http://**.**.**.**/news.asp?Class=20
http://**.**.**.**/dangjian/list.asp?typ=0
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/view.asp?keyno=2365
http://**.**.**.**/show_detail.asp?id=1513
http://**.**.**.**/cn/lvyou/binga.jsp?id=1
http://**.**.**.**/form20130706/scjj.aspx?typeid=26
http://**.**.**.**/view.asp?keyno=11747
http://**.**.**.**/about.asp?id=1
http://**.**.**.**/ztzl.asp?SpecialID=16
http://**.**.**.**/jsdt/show.asp?id=36913
http://**.**.**.**/jgjs/xztj_detail.asp?id=5
http://**.**.**.**/ts.jsp?NewsID=395
http://**.**.**.**/flfg_nei.asp?n_id=89
http://**.**.**.**/smalllist.asp?smallclassid=230
http://**.**.**.**/gk_list_Department.asp?d=63
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/download.aspx?cid=47&id=518
http://**.**.**.**/bigclass.asp?typeid=15&bigclassid=32
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/script/show11.asp?service_id=10
http://**.**.**.**/default.php?mod=article&settype=0&fid=2530
http://**.**.**.**/manage/message/showMsg.aspx?typeid=1
http://**.**.**.**/sortMark.aspx?id=01
http://**.**.**.**/show.aspx?id=157
http://**.**.**.**/asp10/2008_1/xxnr.asp?id=576
http://**.**.**.**/view.asp?keyno=990
http://**.**.**.**/grhd2/E_ReadLeadMail.asp?LeadMailID=981
http://**.**.**.**/CeshiView.asp?id=15
http://**.**.**.**/2012/shenzhen/jianghua.asp?id=1
http://**.**.**.**/common/d.do?catId=104&funcId=10405
http://**.**.**.**/qzjs/news.asp?lei=1
http://**.**.**.**/smalllist.asp?smallclassid=230
http://**.**.**.**/bbs/rss.php?auth=0
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/CeshiView.asp?id=35
http://**.**.**.**/CeshiView.asp?id=7
http://**.**.**.**/work_area.asp?big_id=1
http://**.**.**.**/otype.asp?classid=1
http://**.**.**.**/About.asp?ID=39
http://**.**.**.**/article.asp?id=3
http://**.**.**.**/downinfo.asp?cxid=2
http://**.**.**.**/article/show.php?itemid=1105
http://**.**.**.**/self/projectinfo_list.jsp?depid=2c90808e2b05212e012b08c33c1c0001&depname=%E5%86%9C%E4%B8%9A%E5%B1%80
http://**.**.**.**/wyyd/list.asp?id=22
http://**.**.**.**/main/view.jsp?recid=386017350776
http://**.**.**.**/fzwy.asp?c=45
http://**.**.**.**/home/nr.php?id=1188&PHPSESSID=d613d43454c18d9ba566e2bc12ec6b66
漏洞证明:
修复方案:
和尚:施主 您家房子有洞了,夜深怕有贼人进入 你看这么大的洞...
郭佳佳同学:咦 真的啊. 老和尚 快告诉我建议漏洞的修复方案
和尚:好吧,你家房子是竹木的,还是砖瓦的?让我看看结构图,给您修复方案
郭佳佳:你个花和尚,要我家结构图 你想干嘛?
和尚:罪勒戈过的,修漏洞就是过滤啦 参数化啦等那几个方案,你自己就会修,我连你家房子都没见过,还让我给你修... 最佳修复方案 就是换一个有点安全安全意识的盖房子的人
版权声明:转载请注明来源 老和尚@乌云
漏洞回应
厂商回应:
危害等级:高
漏洞Rank:20
确认时间:2014-07-18 10:20
厂商回复:
CNVD确认并复现所述情况(还在进一步抽查和整理),由于TITLE抓取不完全,还在进一步分类整理,后续将分批次下发给CNCERT各分中心处置。rank 200+
最新状态:
暂无
漏洞评价:
对本漏洞信息进行评价,以更好的反馈信息的价值,包括信息客观性,内容是否完整以及是否具备学习价值
漏洞评价(共4人评价):
登陆后才能进行评分
50%
50%
0%
0%
0%
评论