漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2012-04072
漏洞标题：京东商场存储型XSS
相关厂商：京东商城
漏洞作者： 爱因斯坦
提交时间：2012-01-30 14:13
修复时间：2012-01-31 16:02
公开时间：2012-01-31 16:02
漏洞类型：xss跨站脚本攻击
危害等级：高
自评Rank：15
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2012-01-30： 细节已通知厂商并且等待厂商处理中
2012-01-31： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
存储型XSS，黑盒可以截获到后台信息了哦~
详细说明：
登录。投诉。
漏洞证明：
Date : 2011/12/14 17:31:28
Referer : http://crm.360buy.com:8080/complaintDetails/getComplaintByCaseId.action?caseId=13773133
Cookie : __jdc=97936925; __utmc=97936925; questionnaire=shwchi%2C-1%2C0%2C473; ipLocation=%u4E0A%u6D77; typewid=[{"t":"3963","v":11,"s":"1001598523"},{"t":"655","v":1,"s":"198955"},{"t":"4870","v":0,"s":"19015178"},{"t":"3399","v":-1,"s":"10379866"},{"t":"1351","v":-3,"s":"1001724923"},{"t":"4692","v":-4,"s":"1001529636"},{"t":"2676","v":-5,"s":"502714"},{"t":"1703","v":-6,"s":"531930"},{"t":"831","v":-6,"s":"348583"},{"t":"1639","v":-7,"s":"195800"}]; __jda=97936925.433024842.1323397575.1323837700.1323845802.7; uuid=3fbaf81e-ccc6-4975-9370-ffc0dce05825; __utma=97936925.213249219.1323397575.1323837700.1323845802.29; __utmz=97936925.1323665579.24.16.utmcsr=cc.360buy.com|utmccn=(referral)|utmcmd=referral|utmcct=/sitemanage/order/orderedit.aspx; cn=1; _jzqa=1.50345009619814136.1323405789.1323405789.1323578095.2; _jzqx=1.1323405789.1323578095.2.jzqsr=360buy%2Ecom|jzqct=/product/269056%2Ehtml.jzqsr=360buy%2Ecom|jzqct=/product/140007%2Ehtml; ipLoc-djd=1-72; pin=wangchuanhong; rpin=wangchuanhong; eb=0; _crm_=shwchi%2C%CD%F5%B4%A8%BA%EC%2C473%2C473%2Cnull; __jdv=97936925|direct|-|none|-; ADO_VISITOR_INFO=IK1gywo7AHXJFOKCgBQXNwu7Vp2hU17YJI7e5IFtSBj4S0CgyRrCfJMCVXaNg0IVr39i2TxuO Nr6vBH/G4i5lhnvYdXlOeJmpAtKClTmX6c5qGGAQaFarb4Tmqfh37ysFAaYUbrQyyD6wNWpVG3bra/syVEGy XO5mTrf6F07xs5UZpMJ1r9a/0kPv/sLiefmDGdA==
NoXss : http://这怎么能让你看到/xss/index.php
修复方案：
Are You Kidding Me?
版权声明：转载请注明来源 爱因斯坦@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2012-01-31 16:02
厂商回复：
漏洞Rank：5 (WooYun评价)
最新状态：
暂无