当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0120152

漏洞标题:中国平安保险主站源码泄漏(新)

相关厂商:中国平安保险(集团)股份有限公司

漏洞作者: July

提交时间:2015-06-14 10:56

修复时间:2015-08-03 09:08

公开时间:2015-08-03 09:08

漏洞类型:重要敏感信息泄露

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-06-14: 细节已通知厂商并且等待厂商处理中
2015-06-19: 厂商已经确认,细节仅向厂商公开
2015-06-29: 细节向核心白帽子及相关领域专家公开
2015-07-09: 细节向普通白帽子公开
2015-07-19: 细节向实习白帽子公开
2015-08-03: 细节向公众公开

简要描述:

<中国平安保险(集团)股份有限公司>,主站部分源码泄漏!

详细说明:


<中国平安保险(集团)股份有限公司>,主站部分源码泄漏!

QQ截图20150613010225.png

漏洞证明:

http://www.pingan.com/upload.zip

1.png


<%@ page language="java" contentType="text/html; charset=utf-8" %><%@ taglib 
prefix="c" uri="http://java.sun.com/jstl/core" %><%@ page
import="com.paic.pa18.svc.web.ip2location.IP2LocationManager"%><%@ page
import="com.paic.pa18.svc.web.ip2location.IndexUtil"%><%@ page
import="java.util.ResourceBundle"%><%@ page
import="org.dom4j.Attribute"%><%@ page
import="org.dom4j.Document"%><%@ page
import="org.dom4j.Element"%><%@ page
import="org.dom4j.io.SAXReader"%><%@ page
import="java.util.Iterator"%><%@ page
import="com.paic.pa18.svc.web.util.SecurityUtil"%><%
String url = IndexUtil.doUrl(request, response);
System.out.println("=============================url:="+url);
if(url != null){
String location = request.getRequestURI();
System.out.println("@@@@@@@@@@@@@@@@@@@@@@@location:="+location+"@@@@@@@@@@@@@@@@@@@@@@@");
if(url.indexOf("en") > -1 && location.indexOf("en") < 0){
response.setHeader("Cache-Control", "no-store");
response.setHeader("Pragrma", "no-cache");
response.setDateHeader("Expires", 0);
response.setStatus(HttpServletResponse.SC_MOVED_PERMANENTLY);
response.addHeader("Location",url);
response.setHeader("Connection", "close" );
}
}
%><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta Http-Equiv="Content-Language" content="zh-cn" />
<meta name="smartview_page" content="1">
<meta name="copyright" content="本页版权归中国平安所有。All Rights Reserved" />
<title>中国平安保险(集团)股份有限公司 - 保险,银行,投资</title>
<meta name="SmartView_Page" content="1" />
<meta name="description" content="中国平安保险(集团)股份有限公司是中国第一家以保险为核心的,融证券、信托、银行、资产管理、企业年金等多元金融业务为一体的紧密、高效、多元的综合金融服务集团。">
<meta name="keywords" content="平安保险,人寿保险 公司,财产保险公司,汽车保险,汽车交强保险,保险理财,投资保险,旅游保险,家庭财产保险,医疗 保险,养老 保险 公司,分红保险,健康保险 公司,少儿保险,意外保险,万能保险,投资连结保险,团体保险,企业财产保险,企业员工保险,责任保险,保险 投资 理财"/>
<meta name="verify-v1" content="VGjx1vk/Dv1Smr2egXPmTq45yFK/tNJZToArjh/JVC4=" />
<link rel="stylesheet" type="text/css" href="/app_css/pingan/v20/homepage/style.css" media="all" />
<!--<style>
body{background: url(http://www.pingan.com/homepage/images/2008.jpg) no-repeat center top #fffefc; margin-top:50px;}
</style>-->
<style type="text/css">
<!--
a img{border:none;}
-->
</style>
<!--script>window.open("http://www.pingan.com/homepage/d.html", "", "width=700,height=500")</script-->
<script type="text/javascript">
window.location.href="http://www.pingan.com/";
function searchAction()
{
var searchString ='';
var returnURL ='';
searchString = document.getElementById("searchBox").value;
if(searchString=='')
{
window.alert("请先输入搜索条件,谢谢");
return;
}
returnURL = '/pa18Search/searchAction.do?action=search&search=' + searchString;
window.open(returnURL);
}
function perBankLogin ()
{
var winHref='https://personal.18ebank.com/ibp/';
var eBank=window.open(winHref,'eBank',"menubar=no,toolbar=no,location=no,directories=no,scrollbars=yes,status=yes,resizable=yes,width=800,height=600,top=60,left=100");
eBank.focus();
eBank.opener =null;
}
function enterpriseBankLogin()
{
var winHref='https://enterprise.18ebank.com/ibc/';
var eBank=window.open(winHref,'eBank',"menubar=no,toolbar=no,location=no,directories=no,scrollbars=yes,status=yes,resizable=yes,width=800,height=600,top=60,left=100");
eBank.focus();
eBank.opener =null;
}
</script>
<script src="http://www.pingan.com/app_js/png.js"></script>
<script type="text/JavaScript">
<!--
function MM_openBrWindow(theURL,winName,features) { //v2.0
window.open(theURL,winName,features);
}
//-->
</script>
<script type="text/javascript" src="/app_js/jquery-1.3.2.js"></script>
<script type="text/javascript" src="/app_js/jquery.cookie.js"></script>
<script type="text/javascript" src="/app_js/home_banner.js"></script>
<script type="text/javascript" src="/app_js/AC_RunActiveContent.js"></script>
<script type="text/javascript">
jQuery(function() {
function getDate(dateStr) {
var m = dateStr.match(/^(\d{4})-(\d{1,2})-(\d{1,2})(?: (\d{1,2}):(\d{1,2}):(\d{1,2}))?$/);
if(m) {
var d = new Date();
d.setYear(m[1]);
d.setMonth(m[2] - 1);
d.setDate(m[3]);
d.setHours(m[4] || 0);
d.setMinutes(m[5] || 0);
d.setSeconds(m[6] || 0);
return d;
}
}
var current = new Date();
jQuery("a[special='hot']").each(function() {
var start = jQuery(this).attr("start");
var end = jQuery(this).attr("end");
var startDate = getDate(start);
var endDate = getDate(end);
if(current > startDate && current < endDate) {
jQuery(this).css("vertical-align", "top").after(jQuery("<img border='0'>").attr("src", "/app_images/icon/hot.gif"));
}
});
jQuery("a[special='new']").each(function() {
var start = jQuery(this).attr("start");
var end = jQuery(this).attr("end");
var startDate = getDate(start);
var endDate = getDate(end);
if(current > startDate && current < endDate) {
jQuery(this).css("vertical-align", "top").after(jQuery("<img border='0'>").attr("src", "/app_images/icon/new.gif"));
}
});

var sysDate = getCurrDate();
jQuery("img[endDate][startDate]").each(function() {
var start = jQuery(this).attr("startDate");
var end = jQuery(this).attr("endDate");
var startDate = getMillisecond(start);
var endDate = getMillisecond(end);
if(sysDate >= startDate && sysDate < endDate) {
jQuery(this).show();
}
});
function getCurrDate() {
var objdate=new Date();
var m = objdate.getTime();
return m;
}
function getMillisecond(str) {
var arr = str.split("-");
var yyyy = arr[0];
var mm = arr[1]-1;
var dd = arr[2];
var objdate=new Date(yyyy,mm,dd);
var m = objdate.getTime();
return m;
}
});
function closeCouplet(){
document.getElementById('couplet_l').style.display = 'none';
document.getElementById('couplet_r').style.display = 'none';
document.getElementById('festival').style.width = '100%';
}
</script>
</head>
<body>
<!--<div id="subject"></div>-->
<div>
<div id="container" style="background-color:#FFFFFF">
<!--头部-->
<div id="topnav">
<ul>
<li><a href="http://www.wanlitong.com" target="_blank">万里通积分奖励计划</a></li>
<li><a href="http://ir.pingan.com/index.shtml?ptag=1" target="_blank">投资者关系</a></li>
<li><a href="http://about.pingan.com/index.shtml?ptag=1" target="_blank">关于平安</a></li>
<li><a href="http://www.pingan.com/wap/index.jsp" target="_blank">手机平安网</a></li>
<!--li><a href="https://pa-ssl.pingan.com/pa18Portal/login.jsp" target="_blank">网上理财</a></li-->
<li><a href="http://shop.pingan.com/index.shtml?ptag=1" target="_blank">网上直销</a></li>
<li><a href="http://insurance.pingan.com/qiyebaoxian/index.shtml?ptag=1" target="_blank">企业客户</a></li>
<li><a href="http://insurance.pingan.com/index.shtml?ptag=1" target="_blank">个人客户</a></li>
<li><a href="http://www.pingan.com/">首页</a></li>
</ul>
</div>
<!--<div class="m_t_4"><a href="http://about.pingan.com/pinganxinwen/55726.shtml" target="_blank"><img src="/app_images/pingan/v20/homepage/qifu_01.jpg" alt="祝福灾区,祈福平安。中国平安捐赠500万元投入玉树灾区学校重建。"/></a></div>-->
<div id="header">
<div id="logo"></div>
<div id="logo_txt"></div>
<!--new modify bec-->
<div class="contact"><span>平安服务热线</span><span class="contact_tel"></span><span>在线<strong>咨询</strong>及<strong>投诉</strong></span><span><img src="/app_images/pingan/v20/homepage/arrow.gif" alt="小箭头" /></span><a href="http://www.pingan.com/homepage/contact/contact.jsp?ptag=1" target="_blank" class="contact_btn"></a></div>
<!--new modify end-->
<div id="lang"><a href="http://ir.pingan.com/big5/index.shtml">繁体中文</a>·<a href="http://ir.pingan.com/en/index.shtml">English</a></div>
</div>
<!--头部结束-->
<!--背换广告end-->
<div id="incontainer">
<!--左-->
<div id="left">
<h2 class="left_h2">个人客户</h2>
<div class="left_nav">
<ul>
<li id="pinganone_hoticon"><a href="http://shop.pingan.com/index.shtml?ptag=2" target="_blank" title="网上直销">网上直销</a><img class="pingone_icon" title="hot" alt="hot" src="http://www.pingan.com/homepage/images/pinganone_hoticon.gif"style="left:70px;"/></li>
<li><a href="http://one.pingan.com/index.jsp?ptag=1" target="_blank" title="平安一账通">平安一账通</a></li>
<li><a href="http://insurance.pingan.com/index.shtml?ptag=2" target="_blank" title="保险">保险</a></li>
<li><a href="http://bank.pingan.com/index.shtml" target="_blank" title="银行">银行</a></li>
<li><a href="http://creditcard.pingan.com/index.shtml" target="_blank" title="信用卡">信用卡</a></li>
<li><a href="http://stock.pingan.com" target="_blank" title="证券">证券</a></li>
<li><a href="http://futures.pingan.com/paqh/index.jsp" target="_blank" title="期货">期货</a></li>
<li><a href="http://trust.pingan.com/index.shtml?ptag=1" target="_blank" title="信托">信托</a></li>
<li><a href="http://money.pingan.com/index.shtml?ptag=1" target="_blank" title="理财规划">理财规划</a></li>
<li><a href="http://vip.pingan.com/index.shtml" target="_blank" title="平安VIP俱乐部">平安VIP俱乐部</a></li>
<li><a href="https://www.pingan.com.cn/pinganone/pa/pa18portal.screen" target="_blank" title="网上理财">网上理财</a></li>
</ul>
</div>
<h2 class="left_h2">企业客户</h2>
<div class="left_nav">
<ul>
<li><a href="http://insurance.pingan.com/qiyebaoxian/index.shtml?ptag=2" target="_blank" title="保险">保险</a></li>
<li><a href="http://annuity.pingan.com/index.shtml" target="_blank" title="年金">年金</a></li>
<li><a href="http://bank.pingan.com/qiyeyinhang/index.shtml" target="_blank" title="银行">银行</a></li>
<li><a href="http://stock.pingan.com" target="_blank" title="证券">证券</a></li>
<li><a href="http://futures.pingan.com/paqh/index.jsp" target="_blank" title="期货">期货</a></li>
<li><a href="http://trust.pingan.com/index.shtml?ptag=1" target="_blank" title="信托">信托</a></li>
<li><a href="http://invest.pingan.com/index.shtml" target="_blank" title="投资银行">投资银行</a></li>
<li><a href="http://asset.pingan.com/index.shtml" target="_blank" title="资产管理">资产管理</a></li>
<li><a href="https://pa-ssl.pingan.com/pa18Portal/login_group.jsp" target="_blank" title="网上理财">网上理财</a></li>
</ul>
</div>
<div class="left_nav"><a href="http://www.pingan.com/wap/index.jsp" class="left_nav_a" target="_blank" title="手机平安网">手机平安网</a><img src="http://www.pingan.com/app_images/icon/new.gif"style="margin-left:4px;" alt="new" title="new" /></div>
<div class="left_nav"><a href="http://about.pingan.com/index.shtml?ptag=2" class="left_nav_a" target="_blank" title="关于平安"> 关于平安</a></div>
<div class="left_nav"><a href="http://ir.pingan.com/index.shtml?ptag=2" class="left_nav_a" target="_blank" title="投资者关系">投资者关系</a></div>
<div class="left_nav"><a href="http://www.pingan.com/homepage/contact/contact.jsp?ptag=2" target="_blank" class="left_nav_a" title="联系我们">联系我们</a></div>
<!--
<h3 class="joinus_title">网上门店在线投保</h3>
<div class="joinus_box">
<ul>
<li><a href="/personal/info/yxt_center/cartax.html" target="_blank">汽车交强险和车船税</a></li>
<li><a href="/personal/info/yxt_center/car.html" target="_blank">汽车商业保险</a></li>
<li><a href="/personal/info/yxt_center/moto.html" target="_blank">摩托车交强险和车船税</a></li>
<li><a href="/cms-tmplt/netShop/travelInsurance/default.html" target="_blank">旅行意外保险</a></li>
<li><a href="/cms-tmplt/netShop/abroadInsurance/default.html" target="_blank">境外旅行保险</a></li>
<li><a href="/cms-tmplt/netShop/studyAbroad/default.html" target="_blank">境外留学或工作保险</a></li>
<li><a href="/cms-tmplt/netShop/trafficInsurance/default.html" target="_blank">交通工具意外保险</a></li>
<li><a href="/personal/info/homeInsurance/index.html" target="_blank">家庭财产保险</a></li>
</ul>
</div>
-->
<h3 class="joinus_title"><a href="http://job.pingan.com/" target="_blank" style="color:#FF3c00;" title="加盟平安">加盟平安</a></h3>
<form name="bindForm" method="post" action='http://job.pingan.com/advancedSearch.do'>
<div class="joinus_box"> <span>
<select name='functionId' class="input_text" >
<option selected value="">--全部岗位--</option>
<option value="ADM">行政后勤类</option>
<option value="CRS">客户服务类</option>
<option value="ECO">金融类</option>
<option value="FIN">财务审计统计类</option>
<option value="HDT">酒店餐饮服务类</option>
<option value="HRS">人力资源类</option>
<option value="INS">保险类</option>
<option value="ITN">计算机网络类</option>
<option value="LEG">法律类</option>
<option value="MED">医疗卫生类</option>
<option value="MGT">经营管理类</option>
<option value="MRT">市场公关媒介类</option>
<option value="PRM">项目管理类</option>
<option value="SAL">销售类</option>
<option value="TRS">翻译类</option>
</select>
</span> <span>
<input type="button" name="Submit" value="" class="search_submit1" onclick="bindForm.submit(true);"/>
</span> </div>
</form>
<h3 class="joinus_title">合作伙伴/行销支持</h3>
<div class="joinus_box">
<ul>
<li><a href="javascript:void(0);" onclick="window.open('http://www.pingan.com/property_insurance/pa18AutoInquiry/policyQueryTransfer.jsp','','menubar=no,toolbar=no,location=no,directories=no,scrollbars=yes,status=yes,resizable=yes,top=30,left=20,width=600,height=270');" title="产险网上保单自助查询">产险网上保单自助查询</a></li>
<li><a href="javascript:void(0);" onclick="window.open('dailikehu.htm','','width=530,height=327');" title="代理客户">代理客户</a></li>
<li><a href="http://sales.pa18.com/" target="_blank" title="行销支持管理系统">行销支持管理系统</a></li>
<li><a href="http://sales.pa18.com/" target="_blank" title="产险个人行销系统">产险个人行销系统</a></li>
<li><a href="http://gcss.pingan.com.cn" target="_blank" title="团体客户销售支持系统">团体客户销售支持系统</a></li>
<li><a href="https://gcss.pingan.com.cn/indexSupport.jsp" target="_blank" title="平安团体行销系统GCSS">平安团体行销系统GCSS</a></li>
</ul>
</div>
<h3 class="joinus_title">友情链接</h3>
<div class="joinus_box">
<ul>
<li><a href="http://www.mingyuanfund.com/" target="_blank" title="明园慈善基金">明园慈善基金</a></li>
<li><a href="http://t.sina.com.cn/pingan" target="_blank" title="平安官方微博">平安官方微博</a></li>
</ul>
</div>
</div>
<!--左结束-->
<!--右-->
<div id="right">
<div class="banner">
<iframe marginwidth="0" marginheight="0" src="/adms/area.ctrl?AREAID=QY08012415154358" frameborder=0 width="778" height="194" scrolling="no"></iframe>
</div>
<div class="rightbox_left">
<c:import charEncoding="utf-8" url="/youhuihuodong/youhuihuodong_idx.shtml"/>
<div id="fix_hubox_a" class="c">
<div class="ash_title_bl"></div>
<div class="ash_title_br"></div>
</div>
<h2 class="cbox1">产品和服务信息</h2>
<div class="cbox1_bl"></div>
<div class="cbox1_br"></div>
<div class="clear"></div>
<c:import url="/homepage/pro_ser.html" charEncoding="gbk" />
<!--频道首页热闹资讯 2009/09/29 new add bec-->
<div id="homepage_hotnews" class="m_t_4">
<h2>热门资讯<em class="em_bl"></em><em class="em_br"></em></h2>
<div class="c m_t_4">
<c:import url="/homepage/newinfo.html" charEncoding="gbk" />
<c:import url="/homepage/newinfo2.html" charEncoding="gbk" />
</div>
</div>
<div class="banner2">
<div class="m_t_4">
<iframe marginwidth="0" marginheight="0" src="/adms/area.ctrl?AREAID=QY08012415162160" frameborder=0 width="582" height="106" scrolling="no"></iframe>
<!--
<a href="#"><img src="homepage_images/pingan_index_ipc_131.jpg" alt="" /></a>
-->
</div>
</div>
<h2 class="ash_title">企业客户</h2>
<div class="ash_title_tl"></div>
<div class="ash_title_tr"><a href="http://insurance.pingan.com/qiyebaoxian/index.shtml" target="_blank">更多</a></div>
<c:import url="/group/offer/personal_offer_index2.html" charEncoding="gbk" />
<!--
<div class="news_list">
<ul>
<li><a href="#" target="_blank">平安个人寿险投连产品“聚富年年”正式面世</a></li>
<li><a href="#" target="_blank">快乐体验E路通,保单服务更轻松,还可以参加抽奖</a></li>
<li><a href="#" target="_blank">平安财神通手机炒股!让您投资省时、贴心、方便!</a></li>
<li><a href="#" target="_blank">平安财富·晓扬精选三期集合资金信托计划</a></li>
</ul>
<div class="clear"></div>
</div>
-->
<div class="ash_title_bl"></div>
<div class="ash_title_br"></div>
<div class="clear"></div>
<div class="llbox2_img float_left">
<iframe marginwidth="0" marginheight="0" src="/adms/area.ctrl?AREAID=QY08012415165462" frameborder=0 width="287" height="110" scrolling="no"></iframe>
<!--
<a href="#"><img src="homepage_images/pingan_index_ipc_140.jpg" alt="" /></a>
-->
</div>
<div class="llbox2_img float_right">
<iframe marginwidth="0" marginheight="0" src="/adms/area.ctrl?AREAID=QY08012415173164" frameborder=0 width="287" height="110" scrolling="no"></iframe>
<!--
<a href="#"><img src="homepage_images/pingan_index_ipc_142.jpg" alt="" /></a>
-->
</div>
<div class="clear"></div>
<%@ page import="com.paic.pa18.cms.util.Util" %>
<%!
static Map pageMap = null;
static Map lastFreshTimeMap = null;
%>
<%
try{
String reqUrl = "http://about.pingan.com/pinganxinwen/about_pinganxinwen_idx.jsp";
String resPage = "";
if(pageMap == null || lastFreshTimeMap == null){
pageMap = new HashMap();
lastFreshTimeMap = new HashMap();
resPage = Util.getHttpResponse(reqUrl);
Calendar lastFreshTime = Calendar.getInstance();
pageMap.put(reqUrl, resPage);
lastFreshTimeMap.put(reqUrl, lastFreshTime);
}else{
Calendar currentTime = Calendar.getInstance();
currentTime.add(Calendar.MINUTE, -10);
resPage = (String)pageMap.get(reqUrl);
Calendar lastFreshTime = (Calendar)lastFreshTimeMap.get(reqUrl);
if(resPage == null || resPage == "" || currentTime.after(lastFreshTime)){
lastFreshTime = Calendar.getInstance();
resPage = Util.getHttpResponse(reqUrl);
pageMap.put(reqUrl, resPage);
lastFreshTimeMap.put(reqUrl, lastFreshTime);
}
}%>
<%=resPage.trim()%>
<%
} catch(Exception ex) {
ex.printStackTrace();
}%>
<!--c:import url="http://about.pingan.com/pinganxinwen/about_pinganxinwen_idx.jsp" charEncoding="utf-8" /-->
<!--
<div class="news1_list">
<h2>平安新闻</h2>
<ul>
<li><a href="#" target="_blank">平安财富·晓扬精选三期集合资金信托计划&nbsp;&nbsp;&nbsp;2008-01-18</a></li>
<li><a href="#" target="_blank">中国平安关于平安证券有限责任公司业绩增长提示性公告&nbsp;&nbsp;&nbsp;2008-01-18</a></li>
<li><a href="#" target="_blank">平安财富·晓扬精选三期集合资金信托计划&nbsp;&nbsp;&nbsp;2008-01-18</a></li>
<li><a href="#" target="_blank">中国平安关于平安证券有限责任公司业绩增长提示性公告&nbsp;&nbsp;&nbsp;2008-01-18</a></li>
<li><a href="#" target="_blank">平安财富·晓扬精选三期集合资金信托计划&nbsp;&nbsp;&nbsp;2008-01-18</a></li>
<li><a href="#" target="_blank">中国平安关于平安证券有限责任公司业绩增长提示性公告&nbsp;&nbsp;&nbsp;2008-01-18</a></li>
</ul>
<a href="#" class="news_list_more"></a>
<div class="clear"></div>
</div>
-->
<!--div class="news1_list">
<h2>公司公告</h2>
<ul>
<li><a href="http://www.pingan.com/pa18Web/resources/jsp/openAttach.jsp?fileName=20080320中国平安年报.pdf&storeName=investor/200803/20080319224933924548.pdf" target="_blank">中国平安年报&nbsp;&nbsp;&nbsp;2008-03-20</a></li>
<li><a href="http://www.pingan.com/pa18Web/resources/jsp/openAttach.jsp?fileName=20080320中国平安投资富通投资管理公司的公告.pdf&storeName=investor/200803/20080319232502168245.pdf" target="_blank">中国平安投资富通投资管理公司的公告&nbsp;&nbsp;&nbsp;2008-03-20</a></li>
<li><a href="http://www.pingan.com/pa18Web/resources/jsp/openAttach.jsp?fileName=20080320中国平安年报摘要.pdf&storeName=investor/200803/20080319224908218107.pdf" target="_blank">中国平安年报摘要&nbsp;&nbsp;&nbsp;2008-03-20</a></li>
<li><a href="http://www.pingan.com/pa18Web/resources/jsp/openAttach.jsp?fileName=20080320中国平安保费收入公告.pdf&storeName=investor/200803/20080319231837779271.pdf" target="_blank">中国平安保费收入公告&nbsp;&nbsp;&nbsp;2008-03-20</a></li>
</ul>
<a href="/investor/cn/index.jsp" target="_blank" class="news_list_more"></a>
<div class="clear"></div>
</div>
<div class="clear"></div-->
<%
try{
String reqUrl = "http://ir.pingan.com/zhongyaogonggao/ir_zygg_idx.jsp";
String resPage = "";
if(pageMap == null || lastFreshTimeMap == null){
pageMap = new HashMap();
lastFreshTimeMap = new HashMap();
resPage = Util.getHttpResponse(reqUrl);
Calendar lastFreshTime = Calendar.getInstance();
pageMap.put(reqUrl, resPage);
lastFreshTimeMap.put(reqUrl, lastFreshTime);
}else{
Calendar currentTime = Calendar.getInstance();
currentTime.add(Calendar.MINUTE, -10);
resPage = (String)pageMap.get(reqUrl);
Calendar lastFreshTime = (Calendar)lastFreshTimeMap.get(reqUrl);
if(resPage == null || resPage == "" || currentTime.after(lastFreshTime)){
lastFreshTime = Calendar.getInstance();
resPage = Util.getHttpResponse(reqUrl);
pageMap.put(reqUrl, resPage);
lastFreshTimeMap.put(reqUrl, lastFreshTime);
}
}%>
<%=resPage.trim()%>
<%
} catch(Exception ex) {
ex.printStackTrace();
}%>
<!--c:import url="http://ir.pingan.com/zhongyaogonggao/ir_zygg_idx.jsp" charEncoding="utf-8" /-->
<div class="clear"></div>
</div>
<div class="rightbox_right">

<div class="c_o_a margin_bottom">
<div class="tl"></div>
<div class="tr"></div>
<div class="bl"></div>
<div class="br"></div>
<div class="c_o_b">
<div class="c_o_b_a">一账整合理财更轻松</div>
<div class="c_o_b_e">
<div class="c_o_b_b">
<div class="c_o_b_c">
<ul class="c_l_o_a c">
<li><a class="c_a_a" onclick="window.open('https://www.pingan.com.cn/pinganone/pa/index.screen','toaWin','menubar=no,toolbar=no,location=no,directories=no,scrollbars=yes,status=yes,resizable=yes,top=0,left=0,width='+(screen.availWidth-10)+',height='+(screen.availHeight-45));return false;" href="https://www.pingan.com.cn/pinganone/pa/index.screen" title="登录" otitle="一账通登录" otype="button">登录</a></li>
<li><a href="https://www.pingan.com.cn/pinganone/pa/registerCustomerIndex.do" onclick="window.open('https://www.pingan.com.cn/pinganone/pa/registerCustomerIndex.do','toaWin','menubar=no,toolbar=no,location=no,directories=no,scrollbars=yes,status=yes,resizable=yes,top=0,left=0,width='+(screen.availWidth-10)+',height='+(screen.availHeight-45));return false;" class="c_a_b link_red" title="注册" otitle="一账通注册" otype="button">注册</a></li>
</ul>
<div class="c_l_o_c" pa_ui_name="exscroll" pa_ui_exscroll_speed="50" pa_ui_exscroll_pause="1000">
<ul class="c_l_o_b">
<li><a href="http://bank.pingan.com/youhui/jijindingtouyouhui2/index.shtml" target="_blank">购买基金费率低至3折起</a></li>
<li><a href="http://bank.pingan.com/youhui/ririanying/index.shtml" target="_blank">日日安盈100%本金保障</a></li>
<li><a href="http://bank.pingan.com/youhui/ririshengjin100705/index.shtml" target="_blank">日日生金利息达活期3.75倍</a></li>
<li><a href="http://bank.pingan.com/youhui/cunkuandiya/index.shtml" target="_blank">急用钱不想解定存?有招!</a></li>
<li><a href="http://bank.pingan.com/youhui/cundaitong2/index.shtml" target="_blank">存贷通实现贷款“0”利息</a></li>
<li><a href="http://one.pingan.com/youhui/yizhangtongwangyin_yinhang/index.shtml" target="_blank">注册即享网银汇款转账免费</a></li>
</ul>
</div>
</div>
</div>
</div>
<div class="c_o_b_d"><p><a href="http://one.pingan.com/index.jsp?ptag=2" class="c_a_c" target="_blank">一账通介绍</a></p></div>
</div>
</div>

<div class="c_o_a margin_bottom">
<div class="tl"></div>
<div class="tr"></div>
<div class="bl"></div>
<div class="br"></div>
<div class="c_o_a_a">
<div class="c_p_c_a_1">
<div class="title">一账通卡激活专区
<div class="hot"></div>
</div>
</div>
<div class="c_p_c_a_2">
<div class="tac"><a title="卡片激活" class="a_a" onclick="window.open('https://bank.pingan.com.cn/ibp/portal/activation/activateCard.do','toaWin','menubar=no,toolbar=no,location=no,directories=no,scrollbars=yes,status=yes,resizable=yes,top=0,left=0,width='+(screen.availWidth-10)+',height='+(screen.availHeight-45));return false;" href="https://bank.pingan.com.cn/ibp/portal/activation/activateCard.do">卡片激活</a> <a href="http://one.pingan.com/gongnengyanshi/yizhangtongkajihuo.jsp" title="操作演示" class="a_b" target="_blank">操作演示</a></div>
</div>
</div>
</div>

<div class="rrbox2_top"></div>
<div class="rrbox2">
<h2>个人客户登录</h2>
<a href="https://www.pingan.com.cn/pinganone/pa/index.screen?ptag=2" onclick="window.open('https://www.pingan.com.cn/pinganone/pa/index.screen?modelFlag=101','toaWin','menubar=no,toolbar=no,location=no,directories=no,scrollbars=yes,status=yes,resizable=yes,top=0,left=0,width='+(screen.availWidth-10)+',height='+(screen.availHeight-45));return false;" title="平安一账通">平安一账通</a> <a class="login2_new" href="http://www.pingan.com/campaign/efuwu/yzt/index.jsp" target="_blank" title="寿险网络E服务">寿险网络E服务</a>
<!-- <a href="http://www.pingan.com/campaign/yzt/toa/index1.jsp " target="_blank" title="个人网上理财">个人网上理财</a> -->
<a href="https://www.pingan.com.cn/pinganone/pa/ebanklogin.screen" onclick="window.open('https://bank.pingan.com.cn/ibp/','toaWin','menubar=no,toolbar=no,location=no,directories=no,scrollbars=yes,status=yes,resizable=yes,top=0,left=0,width='+(screen.availWidth-10)+',height='+(screen.availHeight-45));return false;" title="个人网上银行">个人网上银行</a> <a href="http://www.pingan.com/creditcard/ronghe/index.jsp" title="信用卡网上银行" target="_blank">信用卡网上银行</a> <a href="https://stock.pingan.com.cn/pa/stock/wsjy/stock_login.jsp?nextType=gp" title="证券网上营业厅" target="_blank">证券网上营业厅</a> <a href="http://www.pingan.com/customer/oldcustomerlogon.jsp" target="_blank" title="网站会员专区">网站会员专区</a> <a href="https://www.wanlitong.com/eloyalty_chs/start.swe?SWECmd=GotoView&SWEView=Login+View" target="_blank" title="万里通积分奖励计划">万里通积分奖励计划</a> <a href="http://one.pingan.com/shoujiyizhangtong/index.jsp" target="_blank" title="手机一账通">手机一账通</a> <a href="https://www.pingan.com.cn/pinganone/pa/pa18portal.screen" target="_blank" title="寿险网上理财">寿险网上理财</a></div>
<div class="rrbox2_bottom"></div>
<div class="rrbox3_top"></div>
<div class="rrbox3">
<h2>平安网上直销产品</h2>
<ul>
<li><a href="http://shop.pingan.com/baoxian/qichebaoxian.shtml?ptag=1" target="_blank" title="汽车保险">汽车保险</a></li>
<!--li><a href="/shop/product/moto.jsp" target="_blank">摩托车交强险和车船税</a></li-->
<li><a href="http://shop.pingan.com/baoxian/yiwaibaoxian.shtml?ptag=1" target="_blank" title="意外保险">意外保险</a></li>
<li><a href="http://shop.pingan.com/baoxian/lvyoubaoxian.shtml" target="_blank" title="旅游保险">旅游保险</a></li>
<li><a href="http://shop.pingan.com/baoxian/qianzhengbaoxian.shtml" target="_blank" title="签证保险">签证保险</a></li>
<li><a href="http://shop.pingan.com/baoxian/jiatingcaichanbaoxian.shtml" target="_blank" title="家庭财产保险">家庭财产保险</a></li>
<li><a href="http://shop.pingan.com/baoxian/jiankangbaoxian.shtml" target="_blank" title="健康保险">健康保险</a></li>
<li><a href="http://shop.pingan.com/baoxianka/baoxiankagoumai.shtml?ptag=1" target="_blank" title="自助保险卡">自助保险卡</a></li>
<li><a href="http://shop.pingan.com/baoxian/yinianqizongheyiwaixian.shtml" target="_blank" class="login2_new" title="一年期综合意外险">一年期综合意外险
<div id="news"></div>
</a></li>
</ul>
</div>
<div class="rrbox3_bottom"></div>
<div class="rrbox3_top"></div>
<div class="rrbox3">
<h2>个人客户理财工具</h2>
<ul>
<li><a href="/campaign/channels/pingan/car-quote/index.jsp" target="_blank" class="login2_new" title="汽车保险快速报价">汽车保险快速报价
<div id="news"></div>
</a></li>
<li><a href="http://shop.pingan.com/baoxianka/baoxiankagoumai.shtml?ptag=2" target="_blank" title="自助保险卡激活">自助保险卡激活</a></li>
<li><a href="http://insurance.pingan.com/jiagegonggao/wannengxianjiesuanlilvgonggao/wannengxianjiesuanlilvgonggao.shtml" target="_blank" title="万能保险结算利率公告">万能保险结算利率公告</a></li>
<li><a href="http://insurance.pingan.com/jiagegonggao/toulianxiandanweijiage.shtml" target="_blank" title="投连险投资单位价格公告">投连险投资单位价格公告</a></li>
<li><a href="http://insurance.pingan.com/jiagegonggao/licaibaotouzijingzhigonggao.shtml" target="_blank" title="平安理财宝净值公告">平安理财宝净值公告</a></li>
<!--li><a href="http://www.18ebank.com/lilv.jsp?columnId=1252" target="_blank">存贷款利率查询</a></li-->
<!--li><a href="http://www.18ebank.com/info.jsp?columnId=1719" target="_blank">银行资费标准</a></li-->
<li><a href="http://www.pingan.com/property_insurance/pa18AutoInquiry/" target="_blank" title="车险承保理赔查询">车险承保理赔查询</a></li>
<li><a href="http://insurance.pingan.com/baodanchaxun.shtml" target="_blank" title="网上保单查询">网上保单查询</a></li>
<li><a href="http://stock.pingan.com/zhengquanzixun/geguxiangguanhangqing.jsp" target="_blank" title="股票行情查询">股票行情查询</a></li>
</ul>
</div>
<div class="rrbox3_bottom"></div>
<div class="rrbox4_top"></div>
<div class="rrbox4">
<h2>企业客户登录</h2>
<a href="https://pa-ssl.pingan.com/pa18Portal/login_group.jsp" target="_blank" title="企业网上理财">企业网上理财</a> <a href="javascript:enterpriseBankLogin();" title="企业网上银行">企业网上银行</a> </div>
<div class="rrbox4_bottom"></div>
<div class="rrbox3_top"></div>
<div class="rrbox3">
<h2>企业理财工具</h2>
<ul>
<li><a href="/group/insurance/interest_notice.jsp" target="_blank" title="企业万能险结算利率公告">企业万能险结算利率公告</a></li>
<li><a href="/group/insurance/price_notice.jsp" target="_blank" title="企业投连产品价格公告">企业投连产品价格公告</a></li>
<li><a href="javascript:void(0);" onclick="window.open('/pa18Web/annuity/personal/annuity_retire.jsp','','width=575,height=950');" title="退休支付预算">退休支付预算</a></li>
<li><a href="/group/insurance/hospital_serch.jsp" target="_blank" title="企业健康医疗网络查询">企业健康医疗网络查询</a></li>
</ul>
</div>
<div class="rrbox3_bottom"></div>
<div class="rrbox5" id="stock_a">
<h3>平安股价</h3>
<a href="javascript:switchStock(1);" class="fontbold" style="color:#FF3c00;" title="A股">A股</a><span class="fontbold">|</span><a href="javascript:switchStock(2);" class="fontbold" title="H股">H股</a>&nbsp;&nbsp;&nbsp;股票代码:601318
<div class="rrbox5_img"><a href="http://www.pingan.com/investor/cn/stock_A.jsp" target="_blank"><iframe frameborder="no" width="165" scrolling="no" marginwidth="0" marginheight="0" src="http://stock.pingan.com.cn/pa/flash-hq/pahq.htm?code=11601318" ></iframe></a></div>
</div>
<div class="rrbox5" id="stock_h" style="display:none">
<h3>平安股价</h3>
<a href="javascript:switchStock(1);" class="fontbold" title="A股">A股</a><span class="fontbold">|</span><a href="javascript:switchStock(2);" class="fontbold" style="color:#FF3c00;" title="H股">H股</a>&nbsp;&nbsp;&nbsp;股票代码:2318
<div class="rrbox5_img"><a href="http://www.pingan.com/investor/cn/stock_H.jsp" target="_blank"><img src="http://www.irasia.com/cgi-local/stock/drawchart.cgi?code=SEHK.H2318&period=5&timezone=0800&curveType=line&tao=&tas=Volume&spanT=1001&spanH=60&style=irasia-tungtex&width=168&height=130" alt="" border="0" /></a></div>
</div>
<script type="text/javascript">
function switchStock(flag)
{
if(1 == flag)
{
document.getElementById("stock_a").style.display = "block";
document.getElementById("stock_h").style.display = "none";
}
else if(2 == flag)
{
document.getElementById("stock_a").style.display = "none";
document.getElementById("stock_h").style.display = "block";
}
}
</script>
<div class="clear"></div>
</div>
</div>
<!--右结束-->
<div class="clear"></div>
</div>
<div id="foot">
<div id="foot_nav"> <a href="/homepage/protocol.html" target="_blank" title="法律安全">法律安全</a>| <a href="/homepage/article.html" target="_blank" title="使用条款">使用条款</a>| <a href="/homepage/webline.html" target="_blank" title="链接说明">链接说明</a>| <a href="http://job.pingan.com" target="_blank" title="加盟平安">加盟平安</a>| <a href="/homepage/sitemap.html" target="_blank" title="网站地图">网站地图</a> | <a href="/pa18Web/customerservice/docc/contact_us.jsp" target="_blank" title="联系我们">联系我们</a> </div>
<a href="http://www.pingan.com/wap/index.jsp" target="_blank" title="手机平安网">手机平安网</a>: <a href="http://wap.pingan.com" target="_blank">wap.pingan.com</a><br />
版权所有 <span class="foot">&copy; </span>中国平安保险(集团)股份有限公司 未经许可不得复制、转载或摘编,违者必究!<br />
<span class="foot">Copyright &copy; PING AN INSURANCE (GROUP) COMPANY OF CHINA ,LTD. All Rights Reserved</span> <br />
<span class="foot">ICP许可证号 <a href="http://www.miibeian.gov.cn/" target="_blank" title="粤ICP备06118290号">粤ICP备06118290号</a></span> <br />
<a href="http://www.sznet110.gov.cn/index.jsp" target="_blank"><img src="/app_images/pingan/v20/homepage/wang_jing.gif" alt="" border="0" class="foot_img"/></a> <a href="http://www.sznet110.gov.cn/webrecord/innernet/Welcome.jsp?bano=440310120110" target="_blank"><img src="/app_images/pingan/v20/homepage/ns-icon.gif" alt="" border="0"/></a></div>
</div>
</div>
<SCRIPT language=Javascript>
var gDomain="sdc.pingan.com"; // SDC Production Mode Domain
var gDcsId="dcs82b9ujitigdu3gaykxw0hn_5p6b";
var gFpc="WT-FPC";
var gConvert=true;
var gWTIDJS=window.document.createElement("script");
window.document.getElementsByTagName("head")[0].appendChild(gWTIDJS);
if ((typeof(gConvert)!="undefined")&&gConvert&&(document.cookie.indexOf(gFpc+"=")==-1)&&(document.cookie.indexOf("WTLOPTOUT=")==-1)){
gWTIDJS.src="http"+(window.location.protocol.indexOf('https:')==0?'s':'')+"://"+gDomain+"/"+gDcsId+"/wtid.js";
}
</SCRIPT>
<SCRIPT language=Javascript>
setTimeout('setsdcjs()',0);
function setsdcjs(){
var jDomain="www.pingan.com";
var js_path="/personal/sdc/web/sdc_web.js";
var domain="http"+(window.location.protocol.indexOf('https:')==0?'s':'')+"://"+jDomain;
var SDC_js=document.createElement("script");
SDC_js.src=domain+js_path;
var headElem=document.getElementsByTagName("head")[0];
headElem.appendChild(SDC_js);
}
</SCRIPT>
<script type="text/javascript">
function changeUrl() {
var str_mcId=getCookie("MEDIA_SOURCE_NAME");
window.open('https://www.pingan.com.cn/pinganone/pa/registerCustomerEntry.screen?outer_source='+str_mcId,'toaWin','menubar=no,toolbar=no,location=no,directories=no,scrollbars=yes,status=yes,resizable=yes,top=0,left=0,width='+(screen.availWidth-10)+',height='+(screen.availHeight-45));
}
function getCookie(cookie_name) {
var allcookies = document.cookie;
var cookie_pos = allcookies.indexOf(cookie_name);
if (cookie_pos != -1) {
cookie_pos += cookie_name.length + 1;
var cookie_end = allcookies.indexOf(";", cookie_pos);
if (cookie_end == -1) {
cookie_end = allcookies.length;
}
var value = unescape(allcookies.substring(cookie_pos, cookie_end));
return value;
} else {
return '';
}
}
</script>
<script src="/app_js/jquery-1.3.2.js" type="text/javascript"></script>
<script src="/app_js/jquery-ui-1.7.1.js" type="text/javascript"></script>
<script src="/app_js/ui30/js/pa_ui.js" type="text/javascript"></script>
</body>
</html>


修复方案:

自行解决

版权声明:转载请注明来源 July@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:1

确认时间:2015-06-19 09:06

厂商回复:

已下线前端数据

最新状态:

暂无