漏洞概要 关注数(24) 关注此漏洞
缺陷编号:wooyun-2015-095652
漏洞标题:时趣互动敏感信息泄露
相关厂商:social-touch.com
漏洞作者: 看什麼看
提交时间:2015-02-05 11:14
修复时间:2015-02-10 11:16
公开时间:2015-02-10 11:16
漏洞类型:网络敏感信息泄漏
危害等级:高
自评Rank:20
漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]
Tags标签: 无
漏洞详情
披露状态:
2015-02-05: 细节已通知厂商并且等待厂商处理中
2015-02-10: 厂商已经主动忽略漏洞,细节向公众公开
简要描述:
时趣,一个邮箱引起的血案。
详细说明:
好久好久之前,得到了一个时趣的邮箱。
今天发现已经失效了,但是以前收集的信息还是有效
* lirenjuan@shiqutech.com
** github
https://github.com/skybjf/ManageHotel/blob/2b46c0490a9795455be72cec31fe1da88b871584/WebRoot/WEB-INF/classes/hotel-config.properties
#########################################################
jdbc.driverClass=com.mysql.jdbc.Driver
# Database URL
jdbc.url=jdbc:mysql://192.168.0.33:3306/weibo_climb?useUnicode=true&characterEncoding=utf8&characterSetResults=utf8&autoReconnect=true
# Database login information
jdbc.username=mosh
jdbc.password=h@j*y$&$
jdbc.autoCommitOnClose=true
#image save path
operator.image.path=/img/admin/
room.image.path=/img/room/
food.image.path=/img/food/
# CHECK-WARNING.
mail.server.host=smtp.qiye.163.com
mail.server.port=25
mail.server.user=lirenjuan@shiqutech.com
mail.server.pwd=xiaozhen881120
mail.server.from=lirenjuan@shiqutech.com
mail.server.to=lirenjuan@shiqutech.com;guowenbin@social-touch.com;lipeng@shiqutech.com
mail.server.title=cookie check warning
https://github.com/isme-jac/wl_product/blob/7119ea9d751e0fcba09c13adf08c822ba2c8a5c6/core/mail.php
private $DEFAULT_MOSH_MAIL_CONF =
array(
"Host" => "smtp.qiye.163.com",
"Port" => 25,
"SMTPAuth" => true,
"Username" => "noreply1@social-touch.com",
"Password" => "noreply123",
"CharSet" => "utf-8",
"From" => "noreply1@social-touch.com",
"FromName" => "social-touch.com 众趣"
);
private $PROXY_MOSH_MAIL_CONF =
array(
"Host" => "smtp.qiye.163.com",
"Port" => 25,
"SMTPAuth" => true,
"Username" => "noreply1@social-touch.com",
"Password" => "noreply123",
"CharSet" => "utf-8",
"From" => "noreply1@social-touch.com",
"FromName" => "social-touch.com 众趣"
);
漏洞证明:
修复方案:
你们更专业。
版权声明:转载请注明来源 看什麼看@乌云
漏洞回应
厂商回应:
危害等级:无影响厂商忽略
忽略时间:2015-02-10 11:16
厂商回复:
最新状态:
暂无