乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-01-10: 细节已通知厂商并且等待厂商处理中 2014-01-10: 厂商已经确认,细节仅向厂商公开 2014-01-13: 细节向第三方安全合作伙伴开放 2014-03-06: 细节向核心白帽子及相关领域专家公开 2014-03-16: 细节向普通白帽子公开 2014-03-26: 细节向实习白帽子公开 2014-04-10: 细节向公众公开
无限次尝试密码
POST /membership/applylogin.html?returnUrl=%2fdeal%2ftcmemberapplycash.html HTTP/1.1Host: touch.17u.cnProxy-Connection: keep-aliveReferer: http://touch.17u.cn/membership/applylogin.html?returnUrl=%2fdeal%2ftcmemberapplycash.htmlContent-Length: 81Cache-Control: max-age=0Origin: http://touch.17u.cnContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; zh-cn; GT-I9100G Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Accept-Encoding: gzip,deflateAccept-Language: zh-CN, en-USAccept-Charset: utf-8, iso-8859-1, utf-16, gb2312, gbk, *;q=0.7Cookie: BIGipServertouch-17u-cn-pool=1744965804.20480.0000; cnUser=userid=&nickName=&loginType=&token=&authcode=Kd92d35r3kvZvESEJsdnBQ2; loginRecord=name=&pass=; 17uCNRefId=10758821returnUrl=%2Fdeal%2Ftcmemberapplycash.html&LoginName=13812678247&Passwd=q67544130
接口在奖金账户中提现,提现时要重新登录账户密码,无验证码 错误次数不限制
已测试200个错误密码,当成功时候返回数据包长度不同
限制次数 加验证码
危害等级:中
漏洞Rank:5
确认时间:2014-01-10 17:55
正在修复中,多谢!
暂无