当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0124125

漏洞标题:车银通二手车评估系统弱口令导致信息泄露(影响经销商与车辆抵押信息)

相关厂商:车银通

漏洞作者: Tioyer

提交时间:2015-07-02 16:11

修复时间:2015-08-16 16:12

公开时间:2015-08-16 16:12

漏洞类型:后台弱口令

危害等级:中

自评Rank:10

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-07-02: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-08-16: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

域名应该是http://www.35.com旗下。涉及到抵押信息,还款信息,及车主信息。域名归属还确定。

详细说明:

问题系统:cheyintong.com
admin
admin
以下是WHOIS查询结果:

Domain Name: cheyintong.com
Registry Domain ID:
Registrar WHOIS Server: whois.35.com
Registrar URL: http://www.35.com
Updated Date: 2014-12-21T02:49:29.0Z
Creation Date: 2014-01-28T04:00:00.0Z
Registrar Registration Expiration Date: 2018-01-28T04:00:00.0Z
Registrar: 35 Technology Co., Ltd.
Registrar IANA ID: 1316
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone: +86.5925391800
Domain Status: clientTransferProhibited
Registry Registrant ID:
Registrant Name: Niu Shu Liang
Registrant Organization: Niu Shu Liang
Registrant Street: Da Lian Shi Zhong Shan Qu
Registrant City: dalianshi
Registrant State/Province: liaoningsheng
Registrant Postal Code: 116001
Registrant Country: China
Registrant Phone: +86.139 42841677
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email:
Registry Admin ID:
Admin Name: Niu Shu Liang
Admin Organization: Niu Shu Liang
Admin Street: Da Lian Shi Zhong Shan Qu
Admin City: dalianshi
Admin State/Province: liaoningsheng
Admin Postal Code:
Admin Country: China
Admin Phone: +86.139 42841677
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email:
Registry Tech ID:
Tech Name: Niu Shu Liang
Tech Organization: Niu Shu Liang
Tech Street: Da Lian Shi Zhong Shan Qu
Tech City: dalianshi
Tech State/Province: liaoningsheng
Tech Postal Code:
Tech Country: China
Tech Phone: +86.139 42841677
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email:
Name Server: ns9.szhot.com
Name Server: ns10.szhot.com


漏洞证明:

车主.png

信息.png

信息2.png

7.png

111.png

修复方案:

修改密码

版权声明:转载请注明来源 Tioyer@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝

漏洞Rank:8 (WooYun评价)