当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2012-011532

漏洞标题：店铺描述过滤不严URl跳转淘宝客,严重影响用户体验,某些淘宝客利用此漏洞作弊赚钱

相关厂商：淘宝网

漏洞作者： 白帽子

提交时间：2012-08-30 11:15

修复时间：2012-09-04 11:16

公开时间：2012-09-04 11:16

漏洞类型：URL跳转

危害等级：中

自评Rank：8

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2012-08-30： 细节已通知厂商并且等待厂商处理中
2012-09-04： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

店铺描述过滤不严URl跳转淘宝客,严重影响用户体验,某些淘宝客利用此漏洞作弊赚钱,有人月牟利万元甚至更多

详细说明：

此漏洞存在很久,淘宝官方明令禁止的,但是仍然有很多人在使用,具体为:搜索很多热销宝贝会发现很多低价同款宝贝的卖家,点击进去这些卖家的店铺,一般淘宝描述无货,点击链接进总店购买,其实这里面的链接放的就是淘宝客链接,在店铺内部用店铺描述引导别人点击淘宝客链接去赚取佣金,淘宝明令禁止的,普通的淘宝客链接淘宝店铺内页是过滤的,但是经过一些改造的链接淘宝过滤不严,甚至用这种方式可以更改代码设定淘宝客来路.现在淘宝充斥着大量这样的虚假店铺内页.估算在100万以上的页面.严重影响了客户搜索体验!请尽快处理!

漏洞证明：

http://dingyue.taobao.com/dispatcher.do?rs_type=shop&red_url=http://%73%2E%63%6C%69%63%6B%2E%74%61%6F%62%61%6F%2E%63%6F%6D%2F%6A%73%3F%74%75%3D%68%74%74%70%25%33%41%25%32%46%25%32%46%73%2E%63%6C%69%63%6B%2E%74%61%6F%62%61%6F%2E%63%6F%6D%25%32%46%74%25%33%46%65%25%33%44%7A%47%55%33%34%43%41%37%4B%25%32%35%32%42%50%6B%71%42%30%37%53%34%25%32%35%32%46%4B%30%43%46%63%52%66%48%30%47%37%44%62%50%6B%69%4E%39%4D%4A%71%71%79%58%41%78%75%6C%32%6F%79%4C%33%4B%6C%77%71%78%34%58%4C%4C%74%71%43%66%34%6F%49%65%64%25%32%35%32%46%47%69%62%71%43%64%4D%74%31%55%49%37%70%37%75%62%68%63%33%4A%4C%65%78%54%57%43%58%7A%76%6B%66%47%6E%4B%6A%46%31%30%45%25%32%35%32%46%58%4D%62%4C%34%66%6D%79%46%74%6D%46%48%6A%30%41%73%72%72%4A%47%53%6C%33%4C%74%56%79%52%66%72%64%4E%66%47%62%78%65%75%34%79%25%32%35%32%46%6F%4C%58%37%68%57%59%42%76%59%53%66%56%79%7A%25%32%36%70%69%64%25%33%44%6D%6D%5F%32%33%32%31%32%33%32%33%5F%30%5F%30%25%32%36%73%70%6D%25%33%44%32%30%31%34%2E%31%32%31%32%34%38%32%38%2E%31%2E%30%25%32%36%72%65%66%25%33%44%68%74%74%70%25%33%41%25%32%46%25%32%46%71%7A%6F%6E%65%2E%71%71%2E%63%6F%6D
http://member.alisoft.com/member/im?uid=nctaobao&loginid=cn&token=login&imver=0&url=http://%73%2E%63%6C%69%63%6B%2E%74%61%6F%62%61%6F%2E%63%6F%6D%2F%6A%73%3F%74%75%3D%68%74%74%70%25%33%41%25%32%46%25%32%46%73%2E%63%6C%69%63%6B%2E%74%61%6F%62%61%6F%2E%63%6F%6D%25%32%46%74%25%33%46%65%25%33%44%7A%47%55%33%34%43%41%37%4B%25%32%35%32%42%50%6B%71%42%30%37%53%34%25%32%35%32%46%4B%30%43%46%63%52%66%48%30%47%37%44%62%50%6B%69%4E%39%4D%4A%71%71%79%58%41%78%75%6C%32%6F%79%4C%33%4B%6C%77%71%78%34%58%4C%4C%74%71%43%66%34%6F%47%77%56%37%37%54%54%6E%54%56%7A%6D%36%6F%53%43%6B%69%6F%49%4D%30%65%42%30%36%66%44%48%25%32%35%32%46%30%4C%58%36%51%43%73%47%36%35%36%32%6A%79%65%36%39%25%32%35%32%42%6E%6F%74%34%42%36%71%62%50%76%73%49%7A%55%78%47%65%67%5A%71%56%4A%64%44%71%78%57%49%51%6F%31%46%4D%39%58%55%4E%45%25%32%35%32%42%73%68%43%50%7A%4C%74%42%7A%4D%4C%45%59%70%25%32%36%70%69%64%25%33%44%6D%6D%5F%32%33%32%31%32%33%32%33%5F%30%5F%30%25%32%36%73%70%6D%25%33%44%32%30%31%34%2E%31%32%31%32%34%38%32%38%2E%31%2E%30%25%32%36%72%65%66%25%33%44%68%74%74%70%25%33%41%25%32%46%25%32%46%73%2E%31%31%36%2E%63%6F%6DD
http://learn.taobao.com/user/xueyuanRedirect.htm?target=http://%73%2E%63%6C%69%63%6B%2E%74%61%6F%62%61%6F%2E%63%6F%6D%2F%6A%73%3F%74%75%3D%68%74%74%70%25%33%41%25%32%46%25%32%46%73%2E%63%6C%69%63%6B%2E%74%61%6F%62%61%6F%2E%63%6F%6D%25%32%46%74%25%33%46%65%25%33%44%7A%47%55%33%34%43%41%37%4B%25%32%35%32%42%50%6B%71%42%30%37%53%34%25%32%35%32%46%4B%30%43%46%63%52%66%48%30%47%37%44%62%50%6B%69%4E%39%4D%4A%71%71%79%58%41%78%75%6C%32%6F%79%4C%33%4B%6C%77%71%78%34%58%4C%4C%74%71%43%66%34%6F%47%77%56%37%37%54%54%6E%54%56%7A%6D%36%6F%53%43%6B%69%6F%49%4D%30%65%42%30%36%66%44%48%25%32%35%32%46%30%4C%58%36%51%43%73%47%36%35%36%32%6A%79%65%36%39%25%32%35%32%42%6E%6F%74%34%42%36%71%62%50%76%73%49%7A%55%78%47%65%67%5A%71%56%4A%64%44%71%78%57%49%51%6F%31%46%4D%39%58%55%4E%45%25%32%35%32%42%73%68%43%50%7A%4C%74%42%7A%4D%4C%45%59%70%25%32%36%70%69%64%25%33%44%6D%6D%5F%32%33%32%31%32%33%32%33%5F%30%5F%30%25%32%36%73%70%6D%25%33%44%32%30%31%34%2E%31%32%31%32%34%38%32%38%2E%31%2E%30%25%32%36%72%65%66%25%33%44%68%74%74%70%25%33%41%25%32%46%25%32%46%74%65%63%68%2E%73%69%6E%61%2E%63%6F%6D%2E%63%6E
http://member.alisoft.com/member/im?uid=nctaobao&loginid=cn&token=login&imver=0&url=http://%73%38%2E%74%61%6F%62%61%6F%2E%63%6F%6D%2F%73%65%61%72%63%68%3F%71%3D%25%42%30%25%42%32%25%43%38%25%41%42%25%42%34%25%42%38%26%63%61%74%3D%26%6D%6F%64%65%3D%32%33%26%63%6F%6D%6D%65%6E%64%3D%31%25%32%43%32%26%6F%74%68%65%72%5F%66%69%6C%74%65%72%3D%74%6B%5F%72%61%74%65%25%35%42%30%25%32%43%31%30%30%30%30%25%35%44%25%33%42%72%61%74%65%73%75%6D%25%35%42%31%25%32%43%32%30%25%35%44%26%66%69%6C%74%65%72%3D%72%65%73%65%72%76%65%5F%70%72%69%63%65%25%35%42%30%25%32%43%39%39%39%39%39%25%35%44%26%70%69%64%3D%6D%6D%5F%33%31%32%34%30%38%37%30%5F%30%5F%30%26%66%73%3D%31%26%73%6F%72%74%3D%73%61%6C%65%2D%64%65%73%63
http://member.alisoft.com/member/im?uid=nctaobao&loginid=cn&token=login&imver=0&url=http://%73%2E%63%6C%69%63%6B%2E%74%61%6F%62%61%6F%2E%63%6F%6D%2F%74%5F%6A%73%3F%74%75%3D%68%74%74%70%25%33%41%25%32%46%25%32%46%73%2E%63%6C%69%63%6B%2E%74%61%6F%62%61%6F%2E%63%6F%6D%25%32%46%74%25%33%46%65%25%33%44%7A%47%55%33%34%43%41%37%4B%25%32%35%32%42%50%6B%71%42%30%37%53%34%25%32%35%32%46%4B%30%43%46%63%52%66%48%30%48%6A%52%6C%4F%34%59%31%65%4C%33%7A%56%4C%48%37%77%4C%72%33%36%71%73%4C%30%6E%63%65%37%73%6D%41%32%73%35%33%41%4A%6F%57%6F%67%70%48%64%4D%65%72%71%35%72%52%70%55%64%51%71%6A%6E%63%66%76%77%57%73%54%64%43%54%69%72%50%7A%33%59%61%6A%78%70%6B%48%7A%31%71%69%34%79%61%25%32%35%32%42%42%62%61%67%65%62%67%68%51%4D%44%37%34%43%6A%45%49%62%66%50%79%6D%4B%73%68%35%35%33%6D%43%6A%46%72%64%59%31%35%4F%61%78%76%36%59%38%71%4A%52%6B%4B%6A%63%31%67%7A%5A%36%32%69%57%53%4C%6A%57%48%76%59%75%50%53%53%78%6B%68%70%63%62%64%6B%38%53%41%25%32%35%33%44%25%32%35%33%44%25%32%36%70%69%64%25%33%44%6D%6D%5F%33%31%32%34%30%38%37%30%5F%30%5F%30%25%32%36%75%6E%69%64%25%33%44%30%25%32%36%72%65%66%25%33%44%68%74%74%70%25%33%41%25%32%46%25%32%46%77%77%77%2E%68%6F%74%6D%61%69%6C%2E%63%6F%6D
http://s8.taobao.com/search?q=%B0%B2%C8%AB%B4%B8&cat=&mode=23&commend=1%2C2&other_filter=tk_rate%5B0%2C10000%5D%3Bratesum%5B1%2C20%5D&filter=reserve_price%5B0%2C99999%5D&pid=mm_31240870_0_0&fs=1&sort=sale-desc


以上这些链接是我搜集的一些淘宝内页过滤不了的淘宝客链接,这些链接放入正常的淘宝客描述之中点击就可以跳转淘客链接,帮别人获取佣金!

修复方案：

加强代码过滤

版权声明：转载请注明来源 白帽子@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2012-09-04 11:16

厂商回复：

最新状态：

暂无

漏洞评价：

评论

  1. 2012-08-30 16:25 | 无敌L.t.H ( 路人 | Rank:21 漏洞数:4 | ‮……肉肉捉活，亭长放解)

    对于马老板而言没有作弊，运营商，还有宿舍什么的。