乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2012-05-16： 细节已通知厂商并且等待厂商处理中 2012-05-18： 厂商已经主动忽略漏洞，细节向公众公开
淘宝评价系统存在隐患,用户ID泄露,结合利用存在安全隐患！
首先，打开http://rate.taobao.com/detail_rate.htmTB.detailRate = {"scoreInfo": ,"rateListInfo": {"paginator":{"lastPage":0,"page":0,"items":0,"pages":0,"beginIndex":0,"length":0,"firstPage":0,"endIndex":0,"offset":0,"itemsPerPage":10},"watershed":100,"rateList":[],"showMore":0} ,"babyRateJsonList":"uri: /detailRate.vm cacheTime: 2012-05-16 15:35:29 key: 05587a4e435502ca4e128faaXXXXXXXX cacheArea: 118 aliveTime: 28800 cacheType: PAGE_CACHE_PAGE_TYPE" ,"detailRate":"uri: /detailRate.vm cacheTime: 2012-05-16 15:35:29 key: 05587a4e435502ca4e128faXXXXXXXX cacheArea: 118 aliveTime: 28800 cacheType: PAGE_CACHE_PAGE_TYPE"}
关键字存在几十万。
http://rate.taobao.com/rate.htm?user_id=546259XXX 购买记录。user_id泄露 546259XXX 90ea14a146bad0e71ba0XXXXXXXXXXhttp://wow.taobao.com/u/xxxxxxx/view/ta_taoshare_list.htm? 这个是分享链接，买家姓名及地区泄露（购买记录） http://tradearchive.taobao.com/trade/detail/trade_item_detail.htm?bizOrderId=530953972xxxxx 订单号查看个人档案http://member1.taobao.com/member/user_profile.jhtml?user_id=90ea14a146bad0e71ba0a06950XXXXX联系http://member1.taobao.com/message/add_private_msg.htm?recipient_nickname=马甲淘江湖http://jianghu.taobao.com/n/usbU87XEzOyXXXX/front.htmhttp://i.taobao.com/my_taobao.htm?nekot=133711147XXXXX">我的淘宝 http://trade.taobao.com/trade/itemlist/list_bought_items.htm？nekot=usbU87XEzXXXXXX====133711272XXXXusbU87XEzOyxxxxx==等于13371127XXXXX 十三位的
http://rate.taobao.com/detail_rate.htm?userNumId=52159911&auctionNumId=5910946847&showContent=2¤tPage=1&ismore=1&siteID=7
TB.detailRate = {"scoreInfo": {"merchandisScore":"4.8","width":96,"isB2cSeller":false,"noMark":false,"merchandisTotal":3745} ,"rateListInfo": {"paginator":{"lastPage":4,"page":1,"items":62,"pages":4,"beginIndex":1,"length":20,"firstPage":1,"endIndex":20,"offset":0,"itemsPerPage":20},"watershed":100,"rateList":[{"rateContent":"很好","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"依双鱼","type":0,"id":17950973795,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=524642565&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NTI0NjQyNTY1/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":524642565,"dispalyRateLevel2":3,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_3.gif","auctionSku":"","rateDate":"2012.05.09 12:53:39","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":41,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"不错,实用!","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"飘雪zhao","type":0,"id":17822867503,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=171855656&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MTcxODU1NjU2/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":171855656,"dispalyRateLevel2":3,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_3.gif","auctionSku":"","rateDate":"2012.05.05 08:10:08","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":41,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"不错，物美价廉！！","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"赖建华520","type":0,"id":17471286753,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=715790025&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NzE1NzkwMDI1/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":715790025,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_2.gif","auctionSku":"","rateDate":"2012.04.23 12:12:19","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":11,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"不错，质量也不错，卖家好卖家！！！期待长期合作","userVipLevel":2,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"遛*爷","type":0,"id":17441698391,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":3,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_3.gif","auctionSku":"","rateDate":"2012.04.22 11:00:28","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":41,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true},{"rateContent":"还不错。","userVipLevel":2,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"記***你","type":0,"id":17360904927,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":1,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_1.gif","auctionSku":"","rateDate":"2012.04.19 12:38:23","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":251,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true},{"rateContent":"好","userVipLevel":4,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"百威a","type":0,"id":17360486928,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=59813775&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NTk4MTM3NzU=/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":59813775,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_2.gif","auctionSku":"","rateDate":"2012.04.19 12:12:00","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":501,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"很不错的卖家，很不错的东西，很不错的物流！","userVipLevel":4,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"syxlmao","type":0,"id":17327928391,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=346570275&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MzQ2NTcwMjc1/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":346570275,"dispalyRateLevel2":4,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_4.gif","auctionSku":"","rateDate":"2012.04.18 10:27:25","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":92,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"没想象中的好","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"ljlj0714","type":0,"id":17298964727,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=255838232&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MjU1ODM4MjMy/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":255838232,"dispalyRateLevel2":0,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_red_5.gif","auctionSku":"","rateDate":"2012.04.17 11:32:23","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":151,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"帮朋友买的，说不错！","userVipLevel":3,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"s******n","type":0,"id":17232898134,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_2.gif","auctionSku":"","rateDate":"2012.04.15 00:49:50","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":501,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true},{"rateContent":"质量不错 发货也快","userVipLevel":1,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"messenger方","type":0,"id":17176857268,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=649311261&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NjQ5MzExMjYx/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":649311261,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_2.gif","auctionSku":"","rateDate":"2012.04.12 20:58:08","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":11,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"美容店老板说不错哦。","userVipLevel":2,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"yeziqingqing0519","type":0,"id":17119907839,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=194687305&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MTk0Njg3MzA1/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":194687305,"dispalyRateLevel2":3,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_3.gif","auctionSku":"","rateDate":"2012.04.10 20:33:39","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":41,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"东西看起来很不错··卖家发货速度也很快··赞一个","userVipLevel":4,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"xiaoguai0625","type":0,"id":17056283179,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=603462455&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NjAzNDYyNDU1/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":603462455,"dispalyRateLevel2":1,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_1.gif","auctionSku":"","rateDate":"2012.04.08 18:14:50","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":251,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"单独包装，不错","userVipLevel":4,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"y******3","type":0,"id":16753540436,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":0,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_red_5.gif","auctionSku":"","rateDate":"2012.03.28 09:16:40","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":151,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true},{"rateContent":"还没用，看起来不错，先好评一下，掌柜的发货很快哦，谢谢！","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"camry_002","type":0,"id":16623387207,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=261836709&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MjYxODM2NzA5/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":261836709,"dispalyRateLevel2":1,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_1.gif","auctionSku":"","rateDate":"2012.03.23 09:43:35","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":251,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"发货及时，服务好","userVipLevel":3,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"lifuzhensuo","type":0,"id":16504222047,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=134368209&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MTM0MzY4MjA5/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":134368209,"dispalyRateLevel2":4,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_4.gif","auctionSku":"","rateDate":"2012.03.18 20:25:29","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":91,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"很好 很给力 全 5分","userVipLevel":2,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"t******9","type":0,"id":16459072579,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":1,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_1.gif","auctionSku":"","rateDate":"2012.03.16 20:37:25","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":251,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true},{"rateContent":"快递太快了，很好","userVipLevel":2,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"那一季愛上瑋柏","type":0,"id":16343377657,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=628731230&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NjI4NzMxMjMw/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":628731230,"dispalyRateLevel2":3,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_3.gif","auctionSku":"","rateDate":"2012.03.12 14:58:44","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":41,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"太薄了","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"王茹菲儿","type":0,"id":16155469182,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=816203557&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/ODE2MjAzNTU3/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":816203557,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_2.gif","auctionSku":"","rateDate":"2012.03.04 22:03:52","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":11,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"BUCUO","userVipLevel":3,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"芯悝宥数","type":0,"id":16045876765,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=276295532&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/Mjc2Mjk1NTMy/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":276295532,"dispalyRateLevel2":4,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_4.gif","auctionSku":"","rateDate":"2012.02.29 13:02:29","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":91,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"挺好的，郊游的时候用不错哦！","userVipLevel":4,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"t******a","type":0,"id":16011778121,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_2.gif","auctionSku":"","rateDate":"2012.02.27 22:27:45","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":501,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true}],"showMore":0} ,"babyRateJsonList":"uri: /detailRate.vm cacheTime: 2012-05-16 15:47:22 key: f45e3315108001b15efd88325XXXXXX cacheArea: 118 aliveTime: 28800 cacheType: PAGE_CACHE_PAGE_TYPE" ,"detailRate":"uri: /detailRate.vm cacheTime: 2012-05-16 15:47:22 key: f45e3315108001b15efd88325cXXXXXXXcacheArea: 118 aliveTime: 28800 cacheType: PAGE_CACHE_PAGE_TYPE"}
潜在的问题。知道了用户ID,可搜索该购买记录。亲测。结合其他进行攻击的话，还是存在一定问题的。每次上阿里旺旺都有垃圾信息不少，影响用户体验。如果测试的ID是卖家的话，我想拿到其注册邮箱，结合攻击，危害更大。。
你们更专业。
危害等级：无影响厂商忽略
忽略时间：2012-05-18 11:12
非常感谢zeracker对我们的关注
暂无
