当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0141766

漏洞标题：富邦财险某系统多处漏洞打包(泄露大量车主/车辆信息)

相关厂商：富邦财险

漏洞作者： 路人甲

提交时间：2015-09-19 14:49

修复时间：2015-11-05 16:52

公开时间：2015-11-05 16:52

漏洞类型：用户资料大量泄漏

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-19： 细节已通知厂商并且等待厂商处理中
2015-09-21： 厂商已经确认，细节仅向厂商公开
2015-10-01： 细节向核心白帽子及相关领域专家公开
2015-10-11： 细节向普通白帽子公开
2015-10-21： 细节向实习白帽子公开
2015-11-05： 细节向公众公开

简要描述：

这。

详细说明：

问题站点：http://**.**.**.**/
越权加遍历：
http://**.**.**.**/quotation/0501/tbcbpg/UIPrPoEn0501ClaimShowInfo.jsp?claimno=505012014350101004501

7.png


http://**.**.**.**/quotation/0501/tbcbpg/UIPrPoEn0501Show.jsp?BIZTYPE=POLICY&BizNo=805012015350101000262&SHOWTYPE=SHOW&RiskCode=0501&SysCode=prpall
遍历BizNo有详细的车主，车辆信息(姓名，身份证，电话，车牌号，车架号等)

8.png


9.png


SQL注入：
http://**.**.**.**/quotation/0501/tbcbpg/UIPrPoEn0501ClaimShowInfo.jsp?claimno=505012014350101004500

10.png


又是

Database: YWUSER2
+------------------------------+---------+
| Table                        | Entries |
+------------------------------+---------+
| UTIOPERATELOG                | 8381087 |
| PRPCENGAGE                   | 6931618 |
| PRPCPROFITDETAIL             | 6188234 |
| CIREINSUREITEM               | 6076519 |
| PRPPDANGERITEM               | 6031283 |
| PRPCJPLANKIND                | 5631466 |
| WFLOG                        | 5383691 |
| PRPTITEMKIND                 | 5131822 |
| PRPTINSURED                  | 4468715 |
| CIINSUREDEMAND               | 4193855 |
| PRPCITEMKIND                 | 4064766 |
| PRPTDANGERITEM               | 4002812 |
| PRPCITEMKINDORIGIN           | 4002768 |
| PRPCDANGERITEM               | 3992582 |
| PRPCPROFIT                   | 3695205 |
| PRPCINSURED                  | 3549398 |
| PRPCJPLAN                    | 3045258 |
| CIRISKITEM                   | 2871245 |
| PRPJPLANFEE                  | 2768508 |
| PRPJPAYREFRECHIS             | 2766940 |
| BICHECKDEMANDNO              | 2688464 |
| PRPCLIMIT                    | 2576357 |
| VSMARK                       | 2401230 |
| PRPDUSERLOGINERRORTIMES      | 2193297 |
| UWNOTION                     | 1970488 |
| PRPCREINSSHARE               | 1964653 |
| PRPCREINSTRIAL               | 1961759 |
| WFPACKAGE                    | 1855667 |
| SWFLOGSTORE                  | 1785489 |
| VSEXHAUST                    | 1687603 |
| PRPDCUSTOMER                 | 1626372 |
| PRPCDANGERPLAN               | 1599151 |
| PRPCPLAN                     | 1520592 |
| PRPCOMMISSIONDETAIL          | 1383279 |
| PRPTMAIN                     | 1356104 |
| WFOTHERFEES                  | 1312126 |
| CIINSUREDEMANDPAY            | 1292979 |
| PRPJINVOICEINFO              | 1237399 |
| PRPJINVOICELOAN              | 1236375 |
| CILASTPOLICY                 | 1222877 |
| PRPCINSUREDNATURE            | 1218657 |
| PRPCPPROFITDETAIL            | 1201146 |
| PRPPTEXT                     | 1156120 |
| PRPDCUSTOMERIDV              | 1122510 |
| PRPCDANGERTOT                | 1116977 |
| PRPCDANGERUNIT               | 1116973 |
| FCOREPOLICY                  | 1112356 |
| PRPCFEE                      | 1098313 |
| PRPCFEEORIGIN                | 1098304 |
| PRPALLPOLICY                 | 1098250 |
| PRPCMAIN                     | 1098220 |
| PRPCMAINORIGIN               | 1098220 |
| PRPCPENGAGE                  | 1096847 |
| PRPCARDSUB                   | 1078329 |
| CICHECKDEMANDNO              | 1044535 |
| SWFMODELUSE                  | 992081  |
| PRPJFTIME                    | 934755  |
| PRPJPAYREFMAIN               | 875862  |
| PRPJPAYREFDETAIL             | 875224  |
| PRPTITEMCAR                  | 850117  |
| MSG_PHONE_1204               | 785506  |
| MSG_SENDINFO_HIS             | 768671  |
| PRPCMAINSUB                  | 698110  |
| PRPCITEMCAR                  | 660225  |
| PRPCITEMCAREXT               | 660225  |
| PRPCPPROFIT                  | 653253  |
| PRPCOMMISSION                | 646563  |
| CIINSUREVALID                | 610425  |
| PRPCPITEMKIND                | 602648  |
| PRPCEXPENSE                  | 560133  |
| PRPCNAME                     | 559899  |
| PRPCEXPENSEORIGIN            | 549675  |
| PRPCRISKVALUAT               | 542618  |
| PRPMATERIAL                  | 498264  |
| PRPCARD                      | 494581  |
| VSUNUSEDMARK                 | 459730  |
| PRPCPINSURED                 | 457572  |
| PRPPITEMKIND                 | 424260  |
| CICOMMISSIONINFO             | 420478  |
| PRPPREINSTRIAL               | 415080  |
| PRPCPPLAN                    | 405737  |
| PRPTITEMKINDRATEFACTOR       | 383212  |
| PRPCCARSHIPTAX               | 366984  |
| PRPLCLAIMLOSS                | 354178  |
| MSG_SENDINFO                 | 348722  |
| PRPPNAME                     | 300324  |
| PRPDAGREEDETAIL              | 281293  |
| PRPCPNAME                    | 278436  |
| PRPJPAYREFREC                | 267744  |
| PRPCPLIMIT                   | 261080  |
| PRPTPRODUCT                  | 237582  |
| PRPCTRAFFICRECORD            | 213721  |
| PRPCGRADE                    | 203783  |
| PRPDCARMODELNEW              | 203257  |
| PRPPDANGERTOT                | 198620  |
| PRPPDANGERUNIT               | 197687  |
| PRPLLOSS                     | 197016  |
| PRPPHEAD                     | 190824  |
| PRPPMAIN                     | 190824  |
| PRPDCODERISK                 | 188361  |
| VSMARKHIS                    | 182871  |
| PRPCPRODUCT                  | 182748  |
| PRPLCLAIM                    | 181744  |
| PRPCCARRATE                  | 171838  |
| PRPLCOMPENSATE               | 168594  |
| PRPJNOBILLPREFEE             | 157103  |
| PRPTRENEWAL                  | 152413  |
| PRPDFACTOR                   | 146265  |
| PRPCPFEE                     | 139204  |
| PRPCPMAIN                    | 139161  |
| PRPLREGIST                   | 134379  |
| CIENDORVALID                 | 132035  |
| PRPPPROFIT                   | 127844  |
| PRPDRATEUSUAL                | 127543  |
| PRPLCHECK                    | 126024  |
| CIENDORDEMAND                | 123430  |
| PRPCADDRESS                  | 122400  |
| PRPPGRADE                    | 119404  |
| PRPCMAINPROP                 | 119267  |
| PRPTCHARGE                   | 111948  |
| PRPCPMAINSUB                 | 111034  |
| PRPPINSURED                  | 110986  |
| PRPCCHARGE                   | 109423  |
| PRPCCHARGEORIGIN             | 109388  |
| PRPCRENEWAL                  | 107713  |
| PRPCMAINCARGOSUB             | 106050  |
| PRPPEXPENSE                  | 104956  |
| PRPPENGAGE                   | 103345  |
| PRPCITEMCARGO                | 102817  |
| PRPCMAINCARGO                | 101653  |
| PRPCPINSUREDNATURE           | 100380  |
| PRPPFEE                      | 98362   |
| PRPPMAINSUB                  | 88062   |
| PRPCPITEMCAR                 | 87014   |
| PRPCPITEMCAREXT              | 87013   |
| PRPCHARGEDETAIL              | 84759   |
| PRPCPEXPENSE                 | 68985   |
| PRPPITEMCAR                  | 66385   |
| PRPTCOMMONRISK               | 57436   |
| PRPPINSUREDNATURE            | 53962   |
| PRPCPGRADE                   | 51767   |
| PRPPLIMIT                    | 49381   |
| PRPPACCOUNT                  | 45482   |
| PRPPPROFITDETAIL             | 45318   |
| PRPCAUTOPROFITDETAIL         | 41699   |
| PRPCDANGERRISK               | 40893   |
| PRPDCUSTOMERUNIT             | 40626   |
| PRPPITEMCAREXT               | 40486   |
| PRPCPADDRESS                 | 38214   |
| PRPCPCARSHIPTAX              | 34627   |
| PRPDCLAUSE                   | 31581   |
| PRPPPLAN                     | 30311   |
| PRPCMAINCASUALTY             | 29410   |
| PRPPTRAFFICRECORD            | 29340   |
| PRPPDANGERPLAN               | 29133   |
| PRPDCODE                     | 26966   |
| PRPMOTORCADE                 | 26558   |
| PRPCPCARRATE                 | 25974   |
| SWFLOG                       | 23969   |
| PRPCITEMCARMORE              | 22127   |
| PRPCPRISKVALUAT              | 22087   |
| PRPDPROFIT                   | 21712   |
| PRPPCARRATE                  | 20715   |
| UTIUSERGRADETASK             | 19591   |
| PRPCCOINSORIGIN              | 19211   |
| PRPCCOINS                    | 19210   |
| PRPDCARMODELALIAS            | 18820   |
| PRPDEXCH                     | 17507   |
| VSDOSSIER                    | 17306   |
| PRPPMAINLIAB                 | 15336   |
| PRPDUSERLOG                  | 15292   |
| PRPDUSERCALOG                | 15271   |
| PRPCMAINLIAB                 | 14273   |
| PRPCPTRAFFICRECORD           | 13828   |
| PRPDRATECOND                 | 13544   |
| PRPPCARSHIPTAX               | 13511   |
| PRPCCOINSDETAILORIGIN        | 13122   |
| PRPCCOINSDETAIL              | 13121   |
| PRPCDANGERCOINS              | 13121   |
| PRPCCARDRIVER                | 13030   |
| PRPLWEIXINIMGRESORT          | 12758   |
| PRPCAGREEMENT                | 11863   |
| CIWEIXINUPLOADLOG            | 11812   |
| PRPDAGENTBANK                | 10917   |
| PRPDPAYMENTRETURNLOG         | 9787    |
| UTIUSERGRADE                 | 9390    |
| UTIUSERGRADEPOWER            | 8999    |
| PRPCPRENEWAL                 | 8747    |
| PRPDRISKCONFIG               | 8559    |
| PRPCPMAINPROP                | 7979    |
| PRPCITEMDEVICE               | 7949    |
| PRPDRATEUSUALCI              | 7185    |
| UTIGRADETASK                 | 7176    |
| PRPDRATION                   | 7175    |
| PRPPCOINSDETAIL              | 6328    |
| PRPDKIND                     | 6121    |
| PRPCREINSCEDED               | 6035    |
| CIENDORDEMANDPAYDETAIL       | 5214    |
| PRPCMAINCOEFF                | 5158    |
| PRPCPMAINLIAB                | 5062    |
| VSRECYCLE                    | 4642    |
| PRPDUSERSUB                  | 4423    |
| PRPDUSER                     | 4417    |
| PRPDUSERCA                   | 4416    |
| PRPDJOBGROUP                 | 4394    |
| PRPCPAGREEMENT               | 4389    |
| PRPPMAINCASUALTY             | 4343    |
| PRPDPAYMENTRETURN            | 4291    |
| PRPCPMAINCARGOSUB            | 4289    |
| FEOENQUIRY                   | 4257    |
| PRPCCARMODEL                 | 4248    |
| PRPDITEM                     | 4107    |
| PRPCPMAINCARGO               | 4105    |
| PRPCPITEMCARGO               | 4092    |
| PRPCPCOINS                   | 4022    |
| PRPCPCHARGE                  | 3644    |
| PRPDAGREEMENT                | 3616    |
| PRPDCOMAGENT                 | 3494    |
| PRPCPROFITDETAIL_BAK0228     | 3419    |
| PRPPADDRESS                  | 3400    |
| PRPDCONFIGCODE               | 3396    |
| PRPCPCOINSDETAIL             | 3333    |
| PRPDRATEGROUP                | 3287    |
| PRPCPCARDRIVER               | 2976    |
| PRPDAGENT                    | 2878    |
| UTIADMINDISTRICT             | 2859    |
| PRPCPAUTOPROFITDETAIL        | 2716    |
| UTIMENU                      | 2707    |
| CIENDORDEMANDPAY             | 2679    |
| PRPCINSUREDARTIF             | 2662    |
| PRPPCHARGE                   | 2316    |
| PRPCCARDEVICE                | 2090    |
| PRPCMAINCONSTRUCT            | 2038    |
| PRPDCODECOM                  | 1996    |
| PRPPMAINCARGO                | 1982    |
| PRPCPMAINCASUALTY            | 1872    |
| PRPCRISKITEM                 | 1735    |
| PRPCCARSHIPTAXPREDETAIL      | 1717    |
| PRPCPITEMDEVICE              | 1716    |
| PRPDRATE                     | 1627    |
| PRPCPITEMCARMORE             | 1493    |
| CIINSUREDEMANDLOSS           | 1389    |
| UTIJFEECONFIGSUB             | 1368    |
| UTIPARAM                     | 1299    |
| VSCODESET                    | 1260    |
| UTIPLATCONFIG                | 1247    |
| PRPCCUSTOMER                 | 1138    |
| UTIPLATCONFIGRULE            | 1117    |
| PRPDTAXRATE                  | 994     |
| PRPCPCARDEVICE               | 926     |
| PRPDPRODUCT                  | 873     |
| SWFCONDITION                 | 840     |
| PRPPREINSCEDED               | 824     |
| CIRISKWARNING                | 816     |
| PRPLPREPAY                   | 810     |
| PRPCPMAINCOEFF               | 743     |
| PRPCPRISKITEM                | 739     |
| ACCPOSACCOUNT                | 719     |
| PRPCITEMPROP                 | 719     |
| VSSTORAGE                    | 718     |
| PRPPMAINPROP                 | 690     |
| PRPPMAINCARGOSUB             | 688     |
| PRPCPREINSCEDED              | 668     |
| PRPDDEPRECATERATE            | 666     |
| PRPCRISKKIND                 | 627     |
| PRPDRATEFACTOR               | 626     |
| PRPCITEMSHIP                 | 604     |
| PRPCPINSUREDARTIF            | 595     |
| PRPCSHIPDRIVER               | 588     |
| PRPCCARGOITEM                | 585     |
| PRPPCARDRIVER                | 585     |
| PRPDCOMPANY                  | 577     |
| VSINVOICELEVEL               | 551     |
| PRPPITEMCARGO                | 546     |
| PRPCMAINCOVERNOTE            | 526     |
| PRPDREINS                    | 514     |
| UTIADMINCITY                 | 500     |
| UTIJFEECONTROL               | 474     |
| PRPCPROJECT                  | 450     |
| PRPCCOST                     | 436     |
| PRPCPCUSTOMER                | 430     |
| PRPCOLDSHIP                  | 416     |
| PRPPHEADCOVERNOTE            | 370     |
| PRPDRISK                     | 351     |
| PRPDNEWENERGYVECICLES        | 346     |
| PRPPCARDEVICE                | 335     |
| PRPDCLAUSEKIND               | 328     |
| PRPPCARSHIPTAXPREDETAIL      | 327     |
| PRPDCLAIMADJUSTCODE          | 321     |
| NSRLGQK                      | 320     |
| PRPCPMAINCONSTRUCT           | 315     |
| PRPCPCARGOITEM               | 314     |
| SWFPATH                      | 304     |
| PRPCOPENCOVERBAL             | 280     |
| PRPCPCARMODEL                | 274     |
| PRPCPCARSHIPTAXPREDETAIL     | 273     |
| SWFNODE                      | 269     |
| PRPCPITEMPROP                | 264     |
| PRPCPRISKKIND                | 263     |
| PRPJPAYREASONCODE            | 259     |
| PRPPITEMDEVICE               | 248     |
| PRPCPOLDSHIP                 | 232     |
| PRPPITEMCARMORE              | 223     |
| PRPLFILEUPLOADCOLLECTHISTORY | 213     |
| PRPCPPROJECT                 | 190     |
| PRPCPCOST                    | 173     |
| PRPCPMAINCOVERNOTE           | 173     |
| PRPPRISKVALUAT               | 167     |
| PRPCRISKKINDSUB              | 159     |
| UTIJFEECONFIGMAIN            | 150     |
| VSCODE                       | 145     |
| VSCODECOMPANY                | 143     |
| PRPPCARMODEL                 | 142     |
| PRPDUSERINFO                 | 134     |
| PRPPINSUREDARTIF             | 109     |
| PRPCPRISKKINDSUB             | 78      |
| UTICONFIG                    | 74      |
| VSVERSION                    | 66      |
| PRPDRATECONDCI               | 62      |
| PRPCMAINCOVERNOTESUB         | 52      |
| PRPCBIPOLICY                 | 49      |
| PRPMIDDLECOSTDETAIL          | 46      |
| PRPDCARTYPE                  | 43      |
| PRPDTAXCOND                  | 42      |
| PRPJPAYINFO                  | 42      |
| PRPDADDITIONALRATE           | 40      |
| UTIKEY                       | 39      |
| PRPDRATEGROUPCI              | 36      |
| UTIADMINPROVINCE             | 35      |
| MSG_TYPE                     | 34      |
| PRPDTAXCOM                   | 34      |
| PRPCPITEMSHIP                | 32      |
| PRPDCLASS                    | 31      |
| PRPDCURRENCY                 | 31      |
| PRPCPMAINCOVERNOTESUB        | 29      |
| PRPCPSHIPDRIVER              | 29      |
| PRPDLIMITCAR                 | 24      |
| UTISYSTEM                    | 21      |
| NSRSQMX                      | 20      |
| PRPPMAINCONSTRUCT            | 20      |
| HIGHRISKCARSETTER            | 19      |
| UTIPOSCONFIG                 | 15      |
| PRPCBICLAIM                  | 14      |
| PRPJFEEBILLSUB               | 14      |
| PRPCRENEWALCOVERNOTE         | 13      |
| NSRSQXX                      | 8       |
| WFLOGFLAG                    | 8       |
| NSRJBXX                      | 7       |
| PRPDEXIGENCY                 | 7       |
| PRPMIDDLECOST                | 6       |
| MSG_PROVIDER                 | 4       |
| PRPPITEMPROP                 | 3       |
| PRPPITEMSHIP                 | 3       |
| PRPPCOINS                    | 2       |
| PRPREPROPOSAL                | 1       |
+------------------------------+---------+


其中，PRPTITEMCAR表85万信息

11.png


漏洞证明：

11.png

修复方案：

权限限制

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-09-21 16:51

厂商回复：

CNVD确认所述情况,已经转由CNCERT向保险行业信息化主管部门通报,由其后续协调网站管理单位处置.按多个风险点评分,rank 15

最新状态：

暂无