某教育门户CMS存在五处SQL注入

### 简要描述： RT ### 详细说明： 释锐是全国领先的智慧教育解决方案供应商。致力于通过技术创新为中小学、职校、高校和教育行政管理机构提供有竞争力的智慧教育解决方案和服务，持续提升客户体验，为客户创造最大价值。目前，释锐的产品和解决方案已经应用于 25 个省市，服务全国 3000 多所学校。 注入点：index.jsp?groupId=，labelGroup.jsp?labelName=， searchInfo.jsp?orderBy=， groupList.jsp?orderBy=，ta.jsp?tpId=&uuid= 案例： 注入点1： http://chzx.mhedu.sh.cn/bl/groupSpace/templates/1/index.jsp?groupId=group73000000056 http://58.217.106.249/bl/groupSpace/templates/1/index.jsp?groupId=group73000000056 http://www.hszhj.pudong-edu.sh.cn/bl/groupSpace/templates/1/index.jsp?groupId=group73000000056 http://zjyiz.zje.net.cn/bl/groupSpace/templates/1/index.jsp?groupId=group73000000056 http://www.hsjy.pte.sh.cn/bl/groupSpace/templates/1/index.jsp?groupId=group73000000056 http://www.zjyk2z.net/bl/groupSpace/templates/1/index.jsp?groupId=group73000000056 http://www.yk2z.ykedu.net/bl/groupSpace/templates/1/index.jsp?groupId=group73000000056 注入点2： 案例http://chzx.mhedu.sh.cn/bl/groupSpace/group/labelGroup.jsp?labelName= http://58.217.106.249/bl/groupSpace/group/labelGroup.jsp?labelName= http://www.hszhj.pudong-edu.sh.cn/bl/groupSpace/group/labelGroup.jsp?labelName= http://zjyiz.zje.net.cn/bl/groupSpace/group/labelGroup.jsp?labelName= http://www.hsjy.pte.sh.cn/bl/groupSpace/group/labelGroup.jsp?labelName= http://www.zjyk2z.net/bl/groupSpace/group/labelGroup.jsp?labelName= http://www.yk2z.ykedu.net/bl/groupSpace/group/labelGroup.jsp?labelName= 注入点3： 案例： http://chzx.mhedu.sh.cn/bl/groupSpace/searchInfo.jsp?orderBy=%20order%20by%20publish_time%20desc&topList=&keyword= http://58.217.106.249/bl/groupSpace/searchInfo.jsp?orderBy=%20order%20by%20publish_time%20desc&topList=&keyword= http://www.hszhj.pudong-edu.sh.cn/bl/groupSpace/searchInfo.jsp?orderBy=%20order%20by%20publish_time%20desc&topList=&keyword= http://zjyiz.zje.net.cn/bl/groupSpace/searchInfo.jsp?orderBy=%20order%20by%20publish_time%20desc&topList=&keyword= http://www.hsjy.pte.sh.cnbl/groupSpace/searchInfo.jsp?orderBy=%20order%20by%20publish_time%20desc&topList=&keyword= http://www.zjyk2z.net/bl/groupSpace/searchInfo.jsp?orderBy=%20order%20by%20publish_time%20desc&topList=&keyword= http://www.yk2z.ykedu.net/bl/groupSpace/searchInfo.jsp?orderBy=%20order%20by%20publish_time%20desc&topList=&keyword= 注入4： 案例: http://chzx.mhedu.sh.cn/bl/groupSpace/groupList.jsp?orderBy=&topList=&keyword= http://58.217.106.249/bl/groupSpace/groupList.jsp?orderBy=&topList=&keyword= http://www.hszhj.pudong-edu.sh.cn/bl/groupSpace/groupList.jsp?orderBy=&topList=&keyword= http://zjyiz.zje.net.cn/bl/groupSpace/groupList.jsp?orderBy=&topList=&keyword= http://www.hsjy.pte.sh.cn/bl/groupSpace/groupList.jsp?orderBy=&topList=&keyword= http://www.zjyk2z.net/bl/groupSpace/groupList.jsp?orderBy=&topList=&keyword= http://www.yk2z.ykedu.net/bl/groupSpace/groupList.jsp?orderBy=&topList=&keyword= 注入点5： 案例: http://chzx.mhedu.sh.cn/bl/space_inc/ta.jsp?tpId=&uuid= http://58.217.106.249/bl/space_inc/ta.jsp?tpId=&uuid= http://www.hszhj.pudong-edu.sh.cn/bl/space_inc/ta.jsp?tpId=&uuid= http://zjyiz.zje.net.cn/bl/space_inc/ta.jsp?tpId=&uuid= http://www.hsjy.pte.sh.cn/bl/space_inc/ta.jsp?tpId=&uuid= http://www.zjyk2z.net/bl/space_inc/ta.jsp?tpId=&uuid= http://www.yk2z.ykedu.net/bl/space_inc/ta.jsp?tpId=&uuid= ### 漏洞证明： http://chzx.mhedu.sh.cn/bl/groupSpace/templates/1/index.jsp?groupId=group73000000056 [<img src="https://images.seebug.org/upload/201506/1111023881b2593c490bb022e3564f75c35e0c87.jpg" alt="QQ图片20150611110018.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/1111023881b2593c490bb022e3564f75c35e0c87.jpg) http://www.yk2z.ykedu.net/bl/groupSpace/templates/1/index.jsp?groupId=group73000000056 [<img src="https://images.seebug.org/upload/201506/111109264912feb66d20b47570c289f2b628e6ff.jpg" alt="QQ图片20150611110803.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/111109264912feb66d20b47570c289f2b628e6ff.jpg) http://zjyiz.zje.net.cn/bl/groupSpace/group/labelGroup.jsp?labelName= [<img src="https://images.seebug.org/upload/201506/11092601c386c11bb504919d566307b09d415d93.jpg" alt="QQ图片20150611092410.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/11092601c386c11bb504919d566307b09d415d93.jpg) http://www.hszhj.pudong-edu.sh.cn/bl/groupSpace/group/labelGroup.jsp?labelName= [<img src="https://images.seebug.org/upload/201506/11092834219504590b5b22ed622bf3200c35bbce.jpg" alt="QQ图片20150611092712.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/11092834219504590b5b22ed622bf3200c35bbce.jpg) http://58.217.106.249/bl/groupSpace/searchInfo.jsp?orderBy=%20order%20by%20publish_time%20desc&topList=&keyword= [<img src="https://images.seebug.org/upload/201506/110113239ff0d2408d3ebfcd23e39e8c9595c389.jpg" alt="QQ图片20150611011157.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/110113239ff0d2408d3ebfcd23e39e8c9595c389.jpg) http://www.hszhj.pudong-edu.sh.cn/bl/groupSpace/searchInfo.jsp?orderBy=%20order%20by%20publish_time%20desc&topList=&keyword= [<img src="https://images.seebug.org/upload/201506/11012016ac1c6f208f0b4c576a3f3df38d3062f0.jpg" alt="QQ图片20150611011848.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/11012016ac1c6f208f0b4c576a3f3df38d3062f0.jpg) http://58.217.106.249/bl/groupSpace/groupList.jsp?orderBy=&topList=&keyword= [<img src="https://images.seebug.org/upload/201506/11010404228eaaf409400d85cca394fbd4547486.jpg" alt="QQ图片20150611010239.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/11010404228eaaf409400d85cca394fbd4547486.jpg) http://www.hszhj.pudong-edu.sh.cn/bl/groupSpace/groupList.jsp?orderBy=&topList=&keyword= [<img src="https://images.seebug.org/upload/201506/110106364ba9579926d943153d5cbbcd8093df86.jpg" alt="QQ图片20150611010510.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/110106364ba9579926d943153d5cbbcd8093df86.jpg) http://zjyiz.zje.net.cn/bl/space_inc/ta.jsp?tpId=&uuid= [<img src="https://images.seebug.org/upload/201506/11005158579391a9fb74461aeb52c761a46cd45e.jpg" alt="QQ图片20150611005030.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/11005158579391a9fb74461aeb52c761a46cd45e.jpg) http://www.yk2z.ykedu.net/bl/space_inc/ta.jsp?tpId=&uuid= [<img src="https://images.seebug.org/upload/201506/11005607bed4eb0dd41ba2cfcdcd6209b36f63a5.jpg" alt="QQ图片20150611005438.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/11005607bed4eb0dd41ba2cfcdcd6209b36f63a5.jpg)