MES每实内部敏感信息泄露 | wooyun-2015-090347| WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-090347

漏洞标题：MES每实内部敏感信息泄露

漏洞作者： orange

提交时间：2015-01-07 12:18

修复时间：2015-02-21 12:20

公开时间：2015-02-21 12:20

漏洞类型：内部绝密信息泄漏

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-07：积极联系厂商并且等待厂商认领中，细节不对外公开
2015-02-21：厂商已经主动忽略漏洞，细节向公众公开

简要描述：

MES每实内部敏感信息泄露，危及21cake

详细说明：

0x00 关键字

github，llllllllllllllllllllllll

0x01 过程
由于昨天提交了一个21cake的漏洞，出于习惯就上了一下github，搜索关键字 “21cake”

code那里好像有东西

嗯？！ (●′ω`●) svn，顺势看了下去

貌似是短信接口，登了一下发现账户被禁用

继续往下翻

<?php
2	/**
3	 * Cake Detail
4	 * @copyright Copyright (c) 2012, 21cake food co.ltd
5	 * @author 21Cake Dev Team
…	
5	 * @author 21Cake Dev Team
6	 */
7	
8	require(dirname(__FILE__) . '/includes/init.php');
9	$_REQUEST['act'] = empty($_REQUEST['act']) ? 'list' : trim($_REQUEST['act']);

直接进入作者的github主页

https://github.com/llllllllllllllllllllllll?tab=repositories

粗略看了下，源码属于www.mescake.com，加上之前看到@author 21Cake Dev Team于是就联系了一下21cake的工作人员，询问mes与21cake的联系，得知mes是他们在北京的团队

m_alladmin    m-cmsold  m_db_old       m_paltformadmin  m_webadmin
m_call        m_crm     m_html_static  m_security       mweb_main
m_callsearch  m_db      mordercms      mstatic_main     mweb_touch

信息量略大，就用github自带的检索功能，搜索 pass， pwd ，admin，mes等关键字

https://github.com/llllllllllllllllllllllll/mweb_main/search?utf8=%E2%9C%93&q=pass

$db_name   = "shop";
7	
8	// database username
9	$db_user   = "yucheng";
10	
11	// database password
12	$db_pass   = "yucheng";
13	
14	// table prefix

https://github.com/llllllllllllllllllllllll/mordercms/search?utf8=%E2%9C%93&q=pass

5	$my_db_name_write   = "mescake";
6	$my_db_user_write   = "root";
7	$my_db_pass_write   = "";
8	
9	
10	//读操作服务器配置
11	$my_db_host_read   = "210.51.166.149";
…	
11	$my_db_host_read   = "210.51.166.149";
12	$my_db_name_read   = "mescake";
13	$my_db_user_read   = "root";
14	$my_db_pass_read   = "";

https://github.com/llllllllllllllllllllllll/m_crm/search?p=2&q=admin&type=Code&utf8=%E2%9C%93

1	-- phpMyAdmin SQL Dump
2	-- version 4.0.10
3	-- http://www.phpmyadmin.net
4	--
5	-- 主机: localhost
6	-- 生成日期: 2014-04-25 09:43:43
…	
553	INSERT INTO `userinfo` (`id`, `userid`, `userpwd`, `username`, `xingb`, `usertel`, `usermail`, `addtime`, `modytime`, `departmentid`, `parentid`, `departmentname`, `fuze`) VALUES
554	(00000000001, 'admin', 'admin', '管理员', '女', '1890115550', '', '', '', 0, -1, 'admin', '1');

https://github.com/llllllllllllllllllllllll/m_db/search?utf8=%E2%9C%93&q=admin

create table mes_admin(
2	 id int(4) not null primary key auto_increment,
3	 username char(20) not null,
…	
8	INSERT INTO mes_admin (username,password,type) values ('mescakewebadmin','0B6763665B8AB1786EA78780E590ABFB',1);

https://github.com/llllllllllllllllllllllll/m_paltformadmin/search?utf8=%E2%9C%93&q=admin

create table platform_admin_user(
2	 id int(5) not null primary key auto_increment,
3	 realname char(20) not null,
…	
6	 password varchar(256) not null,
7	 extension varchar(256)
8	);
9	
10	insert into platform_admin_user (realname,email,type,password) values ('renyuan','renyuan','0','123456');

https://github.com/llllllllllllllllllllllll/m_paltformadmin/blob/5b74ba982b859c2128894cadf8a3f93cddbadb1c/config.json

[{
  "name":"new_admin",
  "chnName":"新版商品管理平台",
  "url":"http://www.mescake.com/mescakewebadmin/index.php",
  "icon":"iconfont-edit.png"
},{
  "name":"old_admin",
  "chnName":"旧版商品管理平台",
  "url":"http://mes.admin.n.mescake.com/newcake/admin/privilege.php?act=login",
  "icon":"iconfont-edit.png"
},{
  "name":"order_search",
  "chnName":"订单追踪系统(打单，配送)",
  "url":"http://mes.admin.n.mescake.com/ordercms/privilege.php?act=login",
  "icon":"iconfont-tijiaodingdan.png"
},{
  "name":"cash_card",
  "chnName":"礼金卡生成",
  "url":"http://mes.admin.n.mescake.com/czk2/privilege.php?act=login",
  "icon":"iconfont-huiyuanqia.png"
},{
  "name":"email",
  "chnName":"邮件系统",
  "url":"http://ym.163.com/",
  "icon":"iconfont-youjian.png"
},{
  "name":"call",
  "chnName":"客服系统",
  "url":"http://mescall.n.mescake.com/order_all.php?agentuid=1000",
  "icon":"iconfont-edit.png"
},{
  "name":"bug",
  "chnName":"BUG管理系统",
  "url":"http://easybug.net/Member/Login?url=http%3a%2f%2feasybug.net%2fProject%2fProjectInfo%2f10557",
  "icon":"iconfont-bug.png"
},{
  "name":"wiki",
  "chnName":"wiki系统",
  "url":"http://wiki.n.mescake.com",
  "icon":"iconfont-bug.png"
},{
  "name":"sms",
  "chnName":"短信平台",
  "url":"http://sdk.kuai-xin.com:8888/logins.html",
  "icon":"iconfont-faduanxin.png"
},{
  "name":"crm",
  "chnName":"客户关系管理系统",
  "url":"http://crm.n.mescake.com:8081/",
  "icon":"iconfont-crm.png"
}]

其中客服系统可以直接访问

http://mescall.n.mescake.com/order_all.php?agentuid=1

下面的好像涉及到加密算法

https://github.com/llllllllllllllllllllllll/m_security

就贴这些吧

漏洞证明：

如上

修复方案：

删除吧，提高安全意识

版权声明：转载请注明来源 orange@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

WooYun.org

漏洞概要 关注数(24) 关注此漏洞