当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2012-07195

漏洞标题:淘宝评价存在,用户ID泄露,结合利用存在安全隐患!

相关厂商:淘宝网

漏洞作者: zeracker

提交时间:2012-05-16 15:55

修复时间:2012-05-18 11:12

公开时间:2012-05-18 11:12

漏洞类型:敏感信息泄露

危害等级:高

自评Rank:10

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2012-05-16: 细节已通知厂商并且等待厂商处理中
2012-05-18: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

淘宝评价系统存在隐患,用户ID泄露,结合利用存在安全隐患!

详细说明:

首先,打开http://rate.taobao.com/detail_rate.htm
TB.detailRate = {"scoreInfo": ,"rateListInfo": {"paginator":{"lastPage":0,"page":0,"items":0,"pages":0,"beginIndex":0,"length":0,"firstPage":0,"endIndex":0,"offset":0,"itemsPerPage":10},"watershed":100,"rateList":[],"showMore":0} ,"babyRateJsonList":"uri: /detailRate.vm cacheTime: 2012-05-16 15:35:29 key: 05587a4e435502ca4e128faaXXXXXXXX cacheArea: 118 aliveTime: 28800 cacheType: PAGE_CACHE_PAGE_TYPE" ,"detailRate":"uri: /detailRate.vm cacheTime: 2012-05-16 15:35:29 key: 05587a4e435502ca4e128faXXXXXXXX cacheArea: 118 aliveTime: 28800 cacheType: PAGE_CACHE_PAGE_TYPE"}



关键字存在几十万。


http://rate.taobao.com/rate.htm?user_id=546259XXX 购买记录。
user_id泄露 546259XXX 90ea14a146bad0e71ba0XXXXXXXXXX
http://wow.taobao.com/u/xxxxxxx/view/ta_taoshare_list.htm? 这个是分享链接,买家姓
名及地区泄露(购买记录)
http://tradearchive.taobao.com/trade/detail/trade_item_detail.htm?
bizOrderId=530953972xxxxx 订单号
查看个人档案
http://member1.taobao.com/member/user_profile.jhtml?
user_id=90ea14a146bad0e71ba0a06950XXXXX
联系
http://member1.taobao.com/message/add_private_msg.htm?recipient_nickname=马甲
淘江湖
http://jianghu.taobao.com/n/usbU87XEzOyXXXX/front.htm
http://i.taobao.com/my_taobao.htm?nekot=133711147XXXXX">我的淘宝

http://trade.taobao.com/trade/itemlist/list_bought_items.htm?
nekot=usbU87XEzXXXXXX====133711272XXXX
usbU87XEzOyxxxxx==等于13371127XXXXX 十三位的



漏洞证明:

http://rate.taobao.com/detail_rate.htm?userNumId=52159911&auctionNumId=5910946847&showContent=2&currentPage=1&ismore=1&siteID=7


TB.detailRate = {"scoreInfo": {"merchandisScore":"4.8","width":96,"isB2cSeller":false,"noMark":false,"merchandisTotal":3745} ,"rateListInfo": {"paginator":{"lastPage":4,"page":1,"items":62,"pages":4,"beginIndex":1,"length":20,"firstPage":1,"endIndex":20,"offset":0,"itemsPerPage":20},"watershed":100,"rateList":[{"rateContent":"很好","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"依双鱼","type":0,"id":17950973795,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=524642565&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NTI0NjQyNTY1/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":524642565,"dispalyRateLevel2":3,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_3.gif","auctionSku":"","rateDate":"2012.05.09 12:53:39","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":41,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"不错,实用!","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"飘雪zhao","type":0,"id":17822867503,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=171855656&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MTcxODU1NjU2/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":171855656,"dispalyRateLevel2":3,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_3.gif","auctionSku":"","rateDate":"2012.05.05 08:10:08","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":41,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"不错,物美价廉!!","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"赖建华520","type":0,"id":17471286753,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=715790025&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NzE1NzkwMDI1/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":715790025,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_2.gif","auctionSku":"","rateDate":"2012.04.23 12:12:19","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":11,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"不错,质量也不错,卖家好卖家!!!期待长期合作","userVipLevel":2,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"遛*爷","type":0,"id":17441698391,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":3,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_3.gif","auctionSku":"","rateDate":"2012.04.22 11:00:28","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":41,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true},{"rateContent":"还不错。","userVipLevel":2,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"記***你","type":0,"id":17360904927,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":1,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_1.gif","auctionSku":"","rateDate":"2012.04.19 12:38:23","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":251,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true},{"rateContent":"好","userVipLevel":4,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"百威a","type":0,"id":17360486928,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=59813775&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NTk4MTM3NzU=/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":59813775,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_2.gif","auctionSku":"","rateDate":"2012.04.19 12:12:00","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":501,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"很不错的卖家,很不错的东西,很不错的物流!","userVipLevel":4,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"syxlmao","type":0,"id":17327928391,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=346570275&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MzQ2NTcwMjc1/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":346570275,"dispalyRateLevel2":4,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_4.gif","auctionSku":"","rateDate":"2012.04.18 10:27:25","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":92,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"没想象中的好","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"ljlj0714","type":0,"id":17298964727,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=255838232&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MjU1ODM4MjMy/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":255838232,"dispalyRateLevel2":0,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_red_5.gif","auctionSku":"","rateDate":"2012.04.17 11:32:23","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":151,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"帮朋友买的,说不错!","userVipLevel":3,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"s******n","type":0,"id":17232898134,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_2.gif","auctionSku":"","rateDate":"2012.04.15 00:49:50","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":501,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true},{"rateContent":"质量不错 发货也快","userVipLevel":1,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"messenger方","type":0,"id":17176857268,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=649311261&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NjQ5MzExMjYx/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":649311261,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_2.gif","auctionSku":"","rateDate":"2012.04.12 20:58:08","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":11,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"美容店老板说不错哦。","userVipLevel":2,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"yeziqingqing0519","type":0,"id":17119907839,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=194687305&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MTk0Njg3MzA1/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":194687305,"dispalyRateLevel2":3,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_3.gif","auctionSku":"","rateDate":"2012.04.10 20:33:39","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":41,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"东西看起来很不错··卖家发货速度也很快··赞一个","userVipLevel":4,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"xiaoguai0625","type":0,"id":17056283179,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=603462455&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NjAzNDYyNDU1/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":603462455,"dispalyRateLevel2":1,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_1.gif","auctionSku":"","rateDate":"2012.04.08 18:14:50","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":251,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"单独包装,不错","userVipLevel":4,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"y******3","type":0,"id":16753540436,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":0,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_red_5.gif","auctionSku":"","rateDate":"2012.03.28 09:16:40","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":151,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true},{"rateContent":"还没用,看起来不错,先好评一下,掌柜的发货很快哦,谢谢!","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"camry_002","type":0,"id":16623387207,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=261836709&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MjYxODM2NzA5/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":261836709,"dispalyRateLevel2":1,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_1.gif","auctionSku":"","rateDate":"2012.03.23 09:43:35","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":251,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"发货及时,服务好","userVipLevel":3,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"lifuzhensuo","type":0,"id":16504222047,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=134368209&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/MTM0MzY4MjA5/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":134368209,"dispalyRateLevel2":4,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_4.gif","auctionSku":"","rateDate":"2012.03.18 20:25:29","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":91,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"很好 很给力 全 5分","userVipLevel":2,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"t******9","type":0,"id":16459072579,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":1,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_1.gif","auctionSku":"","rateDate":"2012.03.16 20:37:25","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":251,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true},{"rateContent":"快递太快了,很好","userVipLevel":2,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"那一季愛上瑋柏","type":0,"id":16343377657,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=628731230&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/NjI4NzMxMjMw/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":628731230,"dispalyRateLevel2":3,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_3.gif","auctionSku":"","rateDate":"2012.03.12 14:58:44","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":41,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"太薄了","userVipLevel":0,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"王茹菲儿","type":0,"id":16155469182,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=816203557&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/ODE2MjAzNTU3/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":816203557,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_2.gif","auctionSku":"","rateDate":"2012.03.04 22:03:52","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":11,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"BUCUO","userVipLevel":3,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"芯悝宥数","type":0,"id":16045876765,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"http://rate.taobao.com/rate.htm?user_id=276295532&rater=1","rateResult":1,"displayUserLink":"http://wow.taobao.com/u/Mjc2Mjk1NTMy/view/ta_taoshare_list.htm?redirect=fa","displayUserNumId":276295532,"dispalyRateLevel2":4,"fromVirtualHurling":false,"dispalyRateLevel1":1,"displayRatePic":"b_red_4.gif","auctionSku":"","rateDate":"2012.02.29 13:02:29","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":91,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":false},{"rateContent":"挺好的,郊游的时候用不错哦!","userVipLevel":4,"fromOnePai":false,"tag":"","award":"","fromMall":false,"displayUserNick":"t******a","type":0,"id":16011778121,"tradeClosingdate":null,"feedAppendedDO":null,"b2CSeller":false,"reply":"","displayUserRateLink":"","rateResult":1,"displayUserLink":"","displayUserNumId":0,"dispalyRateLevel2":2,"fromVirtualHurling":false,"dispalyRateLevel1":2,"displayRatePic":"b_blue_2.gif","auctionSku":"","rateDate":"2012.02.27 22:27:45","gapDates":0,"ratedUserNumId":52159911,"dispalyRateSum":501,"displayUserSeller":false,"aliMallSeller":false,"shareInfo":{"share":false,"userNumIdBase64":"","reply":0,"pic":0,"lastReplyTime":""},"fromB2cMapping":false,"anony":true}],"showMore":0} ,"babyRateJsonList":"uri: /detailRate.vm cacheTime: 2012-05-16 15:47:22 key: f45e3315108001b15efd88325XXXXXX cacheArea: 118 aliveTime: 28800 cacheType: PAGE_CACHE_PAGE_TYPE" ,"detailRate":"uri: /detailRate.vm cacheTime: 2012-05-16 15:47:22 key: f45e3315108001b15efd88325cXXXXXXXcacheArea: 118 aliveTime: 28800 cacheType: PAGE_CACHE_PAGE_TYPE"}


潜在的问题。
知道了用户ID,可搜索该购买记录。
亲测。
结合其他进行攻击的话,还是存在一定问题的。
每次上阿里旺旺都有垃圾信息不少,影响用户体验。
如果测试的ID是卖家的话,我想拿到其注册邮箱,结合攻击,危害更大。。

修复方案:

你们更专业。

版权声明:转载请注明来源 zeracker@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2012-05-18 11:12

厂商回复:

非常感谢zeracker对我们的关注

最新状态:

暂无


漏洞评价:

评论

  1. 2012-05-16 16:40 | 一刀终情 ( 普通白帽子 | Rank:156 漏洞数:28 | ‮‮PKAV技术宅社区-安全爱好者)

    刷信用么?

  2. 2012-05-18 11:33 | zeracker 认证白帽子 ( 核心白帽子 | Rank:1068 漏洞数:137 | 多乌云、多机会!微信公众号: id:a301zls ...)

    影响用户体验,间接提高经济销量,可谓的营销。

  3. 2012-05-18 11:39 | 蟋蟀哥哥 ( 普通白帽子 | Rank:363 漏洞数:57 | 巴蜀人士,80后宅男,自学成才,天朝教育失败...)

    忽略了。。。

  4. 2012-05-18 11:44 | xsser 认证白帽子 ( 普通白帽子 | Rank:254 漏洞数:18 | 当我又回首一切,这个世界会好吗?)

    的确不是敏感数据

  5. 2012-05-18 12:07 | zeracker 认证白帽子 ( 核心白帽子 | Rank:1068 漏洞数:137 | 多乌云、多机会!微信公众号: id:a301zls ...)

    @xsser 我只能说催生了一些经济利益吧。

  6. 2012-05-18 12:26 | zeracker 认证白帽子 ( 核心白帽子 | Rank:1068 漏洞数:137 | 多乌云、多机会!微信公众号: id:a301zls ...)

    @xsser 比如我知道你的ID,可以找到你买过物品的记录,果断可以社工,通过各种伎俩拿到你购买纪录并且获得你的敏感信息,我只想说的是只是存在隐患,需要结合其他进行攻击的。亲测的。

  7. 2012-05-18 12:27 | xsser 认证白帽子 ( 普通白帽子 | Rank:254 漏洞数:18 | 当我又回首一切,这个世界会好吗?)

    @zeracker 知道ID能知道别人买过东西的记录?

  8. 2012-05-18 12:39 | zeracker 认证白帽子 ( 核心白帽子 | Rank:1068 漏洞数:137 | 多乌云、多机会!微信公众号: id:a301zls ...)

    @xsser 部分评价可以查到的。你可以拿自己测试的。如:site:http://rate.taobao.com/detail_rate.htm 剑心元user_id=89719822 在09年淘宝出过一个bug,知道ID可以查到卖家的注册邮箱及姓名等信息,我提交的晚上找过以前的相关信息的,的确是存在的,暂时找不到那个地址了。

  9. 2012-05-18 17:59 | zeracker 认证白帽子 ( 核心白帽子 | Rank:1068 漏洞数:137 | 多乌云、多机会!微信公众号: id:a301zls ...)

    对于淘宝炒信用的那个乌云链接,我表示没看过。不了解情况,人格担保。一码归一码,