当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0130673

漏洞标题：车猫网多个漏洞大礼包(涉及大量内部敏感信息)

相关厂商：dongdalou.com

漏洞作者： 路人甲

提交时间：2015-08-13 15:29

修复时间：2015-09-27 15:38

公开时间：2015-09-27 15:38

漏洞类型：重要敏感信息泄露

危害等级：中

自评Rank：10

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-08-13： 细节已通知厂商并且等待厂商处理中
2015-08-13： 厂商已经确认，细节仅向厂商公开
2015-08-23： 细节向核心白帽子及相关领域专家公开
2015-09-02： 细节向普通白帽子公开
2015-09-12： 细节向实习白帽子公开
2015-09-27： 细节向公众公开

简要描述：

4个漏洞打包提交！
车猫致力于建立中国最大的二手车交易平台，为消费者提供二手车交易的顾问服务、金融贷款服务和售后保障产品，车猫秉承着“让买卖二手车更简单”的理念，不断完善产品体验，设计提供更加简单便捷交易的产品为用户提供独一无二的消费体验，让消费者体验安全、保障、舒适和放心的购车经历，其中包括：全国覆盖面最广车源最多的线上二手车商城，降低消费门槛、提升购车体验的专业购车顾问团队，杜绝欺诈、保障二手车品质的车猫认证与质保服务，快速便捷的贷款、抵押等金融服务，以及完善一站式体验的各种汽车后市场服务等。

详细说明：

1.车猫网邮箱弱口令
[email protected]
fcwl1234
打码

admin.png


2.车猫网ftp弱口令包含敏感信息
cert.chemao.com.cn＝112.124.20.137
ftpuser
fcwl1234

c.png

漏洞证明：

3.车猫网某分站敏感信息泄漏
http://bc.chemao.com.cn/.svn/entries

mysql.png


<?php
//车猫合作商管理平台
$db['default']['hostname'] = '127.0.0.1';
$db['default']['username'] = 'fcwl';//'root';
$db['default']['password'] = 'fcwl123';
$db['default']['database'] = 'business_online';
$db['default']['dbdriver'] = 'mysql';
$db['default']['dbprefix'] = '';
$db['default']['pconnect'] = false;
$db['default']['db_debug'] = TRUE;
$db['default']['cache_on'] = FALSE;
$db['default']['cachedir'] = '';
$db['default']['char_set'] = 'gbk';
$db['default']['dbcollat'] = 'gbk_chinese_ci';
$db['default']['swap_pre'] = '';
$db['default']['autoinit'] = TRUE;
$db['default']['stricton'] = FALSE;
$db['default']['port'] = 3306;
//车猫ERP管理平台
$db['erp']['hostname'] = '127.0.0.1';
$db['erp']['username'] = 'fcwl';//'root';
$db['erp']['password'] = 'fcwl123';
$db['erp']['database'] = 'erp_online';
$db['erp']['dbdriver'] = 'mysql';
$db['erp']['dbprefix'] = '';
$db['erp']['pconnect'] = false;
$db['erp']['db_debug'] = TRUE;
$db['erp']['cache_on'] = FALSE;
$db['erp']['cachedir'] = '';
$db['erp']['char_set'] = 'gbk';
$db['erp']['dbcollat'] = 'gbk_chinese_ci';
$db['erp']['swap_pre'] = '';
$db['erp']['autoinit'] = TRUE;
$db['erp']['stricton'] = FALSE;
$db['erp']['port'] = 3306;
//车猫数据库配置
$db['dongdalou']['hostname'] = '127.0.0.1';
$db['dongdalou']['username'] = 'fcwl';//'root';
$db['dongdalou']['password'] = 'fcwl123';
$db['dongdalou']['database'] = '365eche_online';
$db['dongdalou']['dbdriver'] = 'mysql';
$db['dongdalou']['dbprefix'] = '';
$db['dongdalou']['pconnect'] = false;
$db['dongdalou']['db_debug'] = TRUE;
$db['dongdalou']['cache_on'] = FALSE;
$db['dongdalou']['cachedir'] = '';
$db['dongdalou']['char_set'] = 'gbk';
$db['dongdalou']['dbcollat'] = 'gbk_chinese_ci';
$db['dongdalou']['swap_pre'] = '';
$db['dongdalou']['autoinit'] = TRUE;
$db['dongdalou']['stricton'] = FALSE;
$db['dongdalou']['port'] = 3306;
//认证项目数据库配置文件
$db['cert']['hostname'] = '127.0.0.1';
$db['cert']['username'] = 'fcwl';//'root';
$db['cert']['password'] = 'fcwl123';
$db['cert']['database'] = 'cert_online';
$db['cert']['dbdriver'] = 'mysql';
$db['cert']['dbprefix'] = '';
$db['cert']['pconnect'] = false;
$db['cert']['db_debug'] = TRUE;
$db['cert']['cache_on'] = FALSE;
$db['cert']['cachedir'] = '';
$db['cert']['char_set'] = 'gbk';
$db['cert']['dbcollat'] = 'gbk_chinese_ci';
$db['cert']['swap_pre'] = '';
$db['cert']['autoinit'] = TRUE;
$db['cert']['stricton'] = FALSE;
$db['cert']['port'] = 3306;


4.车猫网某站敏感信息泄漏/包含支付各大任意接口id号
http://a.chemao.com.cn//.svn/entries

<?php
/**
 * 支付方式--财付通--配置信息
 * @author tangm
 */
return array(
    'code'      => 'tenpay',
    'name'      => Lang::get('tenpay'),
    'desc'      => Lang::get('tenpay_desc'),
    'website'   => 'https://www.tenpay.com/v2/',
    'version'   => '1.0',
	/*签约信息*/
    'tenpay_account'  => '自助商户测试帐户',//账号(商户名称)
    'tenpay_key'  => 'e82573dc7e6136ba414f2e2affbe39fa',//密钥(安全检验码)
    'tenpay_partner'  => '1900000113',//合作者身份ID(商户号)
    'tenpay_trade_mode'  => '1',//交易类型 -- 1 即时到账  2 中介担保 3 后台选择
    'test_host'  => 'http://dev.365eche.com:8080/',//测试url，因为通知需要外网可访问的url,上线时务必置空！
	/*支付显示信息*/
    'company'  => '杭州车猫网络科技有限公司',//公司信息
    'payment_desc'  => '车猫--财付通支付',//支付信息
);
?>


<?php
//数据库配置文件
$db['default']['hostname'] = '10.135.14.136';
$db['default']['username'] = 'fcwl';
$db['default']['password'] = 'fcwl123';
$db['default']['database'] = '365eche_online';
$db['default']['dbdriver'] = 'mysql';
$db['default']['dbprefix'] = '';
$db['default']['pconnect'] = false;
$db['default']['db_debug'] = TRUE;
$db['default']['cache_on'] = FALSE;
$db['default']['cachedir'] = '';
$db['default']['char_set'] = 'gbk';
$db['default']['dbcollat'] = 'gbk_chinese_ci';
$db['default']['swap_pre'] = '';
$db['default']['autoinit'] = TRUE;
$db['default']['stricton'] = FALSE;
$db['default']['port'] = 3306;
// 从机配置
$db['default']['slave'][0]['hostname'] = '10.168.170.152';
$db['default']['slave'][0]['username'] = 'slave';
$db['default']['slave'][0]['password'] = 'fcwl123';
$db['default']['slave'][0]['database'] = '365eche_online';
$db['default']['slave'][0]['dbdriver'] = 'mysql';
$db['default']['slave'][0]['dbprefix'] = '';
$db['default']['slave'][0]['pconnect'] = false;
$db['default']['slave'][0]['db_debug'] = TRUE;
$db['default']['slave'][0]['cache_on'] = FALSE;
$db['default']['slave'][0]['cachedir'] = '';
$db['default']['slave'][0]['char_set'] = 'gbk';
$db['default']['slave'][0]['dbcollat'] = 'gbk_chinese_ci';
$db['default']['slave'][0]['swap_pre'] = '';
$db['default']['slave'][0]['autoinit'] = TRUE;
$db['default']['slave'][0]['stricton'] = FALSE;
$db['default']['slave'][0]['port'] = 3306;
$db['default']['slave'][0]['weight'] = 70; //查询负载比重
$db['operation']['hostname'] = '10.160.26.243';
$db['operation']['username'] = 'fcwl';
$db['operation']['password'] = 'fcwl123$';
$db['operation']['database'] = 'operation_online';
$db['operation']['dbdriver'] = 'mysql';
$db['operation']['dbprefix'] = '';
$db['operation']['pconnect'] = false;
$db['operation']['db_debug'] = TRUE;
$db['operation']['cache_on'] = FALSE;
$db['operation']['cachedir'] = '';
$db['operation']['char_set'] = 'gbk';
$db['operation']['dbcollat'] = 'gbk_chinese_ci';
$db['operation']['swap_pre'] = '';
$db['operation']['autoinit'] = TRUE;
$db['operation']['stricton'] = FALSE;
$db['operation']['port'] = 3306;
$db['behavior']['hostname'] = '10.117.31.29';
$db['behavior']['username'] = 'fcwl';
$db['behavior']['password'] = 'fcwl123$';
$db['behavior']['database'] = 'behavior_online';
$db['behavior']['dbdriver'] = 'mysql';
$db['behavior']['dbprefix'] = '';
$db['behavior']['pconnect'] = false;
$db['behavior']['db_debug'] = TRUE;
$db['behavior']['cache_on'] = FALSE;
$db['behavior']['cachedir'] = '';
$db['behavior']['char_set'] = 'gbk';
$db['behavior']['dbcollat'] = 'gbk_chinese_ci';
$db['behavior']['swap_pre'] = '';
$db['behavior']['autoinit'] = TRUE;
$db['behavior']['stricton'] = FALSE;
$db['behavior']['port'] = 3306;
$db['erp']['hostname'] = '10.160.26.243';
$db['erp']['username'] = 'fcwl';
$db['erp']['password'] = 'fcwl123$';
$db['erp']['database'] = 'erp_online';
$db['erp']['dbdriver'] = 'mysql';
$db['erp']['dbprefix'] = '';
$db['erp']['pconnect'] = false;
$db['erp']['db_debug'] = TRUE;
$db['erp']['cache_on'] = FALSE;
$db['erp']['cachedir'] = '';
$db['erp']['char_set'] = 'gbk';
$db['erp']['dbcollat'] = 'gbk_chinese_ci';
$db['erp']['swap_pre'] = '';
$db['erp']['autoinit'] = TRUE;
$db['erp']['stricton'] = FALSE;
$db['erp']['port'] = 3306;
$db['hx2car']['hostname'] = '10.160.26.243';
$db['hx2car']['username'] = 'fcwl';
$db['hx2car']['password'] = 'fcwl123$';
$db['hx2car']['database'] = 'hx2car_online';
$db['hx2car']['dbdriver'] = 'mysql';
$db['hx2car']['dbprefix'] = '';
$db['hx2car']['pconnect'] = false;
$db['hx2car']['db_debug'] = TRUE;
$db['hx2car']['cache_on'] = FALSE;
$db['hx2car']['cachedir'] = '';
$db['hx2car']['char_set'] = 'gbk';
$db['hx2car']['dbcollat'] = 'gbk_chinese_ci';
$db['hx2car']['swap_pre'] = '';
$db['hx2car']['autoinit'] = TRUE;
$db['hx2car']['stricton'] = FALSE;
$db['hx2car']['port'] = 3306;
$db['cert']['hostname'] = '10.160.26.243';
$db['cert']['username'] = 'fcwl';
$db['cert']['password'] = 'fcwl123$';
$db['cert']['database'] = 'cert_online';
$db['cert']['dbdriver'] = 'mysql';
$db['cert']['dbprefix'] = '';
$db['cert']['pconnect'] = false;
$db['cert']['db_debug'] = TRUE;
$db['cert']['cache_on'] = FALSE;
$db['cert']['cachedir'] = '';
$db['cert']['char_set'] = 'gbk';
$db['cert']['dbcollat'] = 'gbk_chinese_ci';
$db['cert']['swap_pre'] = '';
$db['cert']['autoinit'] = TRUE;
$db['cert']['stricton'] = FALSE;
$db['cert']['port'] = 3306;


c1.png

修复方案：

。。。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：7

确认时间：2015-08-13 15:37

厂商回复：

确实泄露了我们的一些重要信息，多谢发现并及时提醒。后续我们会在细节处更加注意安全。

最新状态：

暂无