某政府信息公开系统存在SQL注入

### 简要描述： RT ### 详细说明： 吉大正元信息技术股份有限公司:http://www.jit.com.cn/ 众多政府网站都在使用该系统 我就用5个案例来测试。 注入链接是： ``` /zwdtSjgl/Directory/showDir.jsp?keyid= ``` 案例： ``` http://www.ilj.gov.cn/zwdtSjgl/Directory/showDir.jsp?keyid=PI201307051520180523 http://218.27.207.21/zwdtSjgl/Directory/showDir.jsp?keyid=PI201101131105070841 http://zwgk.wangqing.gov.cn/zwdtSjgl/Directory/showDir.jsp?keyid=PI201412181107440207 http://218.62.81.171/zwdtSjgl/Directory/showDir.jsp?keyid=PI201101131105070841 http://218.62.100.33:8000/zwdtSjgl/Directory/showDir.jsp?keyid=PI201101131105070841 ``` ### 漏洞证明： 案例一： ``` http://www.ilj.gov.cn/zwdtSjgl/Directory/showDir.jsp?keyid=PI201307051520180523 ``` [<img src="https://images.seebug.org/upload/201412/25174435f18bd45789c2887ae380666cb2235cba.jpg" alt="01.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/25174435f18bd45789c2887ae380666cb2235cba.jpg) ``` ``` 案例二： ``` http://218.27.207.21/zwdtSjgl/Directory/showDir.jsp?keyid=PI201101131105070841 ``` [<img src="https://images.seebug.org/upload/201412/251744510df6676c06272dc7b8f79d6dd6ac6cd1.jpg" alt="02.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/251744510df6676c06272dc7b8f79d6dd6ac6cd1.jpg) ``` ``` 案例三： ``` http://zwgk.wangqing.gov.cn/zwdtSjgl/Directory/showDir.jsp?keyid=PI201412181107440207 ``` [<img src="https://images.seebug.org/upload/201412/25174506c6bcb3e376a9d34b79f5915adb67d4c2.jpg" alt="03.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/25174506c6bcb3e376a9d34b79f5915adb67d4c2.jpg) ``` ```