当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-071802

漏洞标题:南方航空某系统存在敏感信息严重泄露

相关厂商:中国南方航空股份有限公司

漏洞作者: cf_hb

提交时间:2014-08-10 11:09

修复时间:2014-09-24 11:10

公开时间:2014-09-24 11:10

漏洞类型:未授权访问/权限绕过

危害等级:中

自评Rank:10

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-08-10: 细节已通知厂商并且等待厂商处理中
2014-08-11: 厂商已经确认,细节仅向厂商公开
2014-08-21: 细节向核心白帽子及相关领域专家公开
2014-08-31: 细节向普通白帽子公开
2014-09-10: 细节向实习白帽子公开
2014-09-24: 细节向公众公开

简要描述:

中国南方航空公司某后台管理系统存在目录访问权限设置不严,导致整个管理平台的管理日志信息,用户线上交流信息全部泄露出来。包括用户机票订单号,用户联系方式,家庭地址等泄露。分析服务器日志 可以看到部分数据库表名 ,字段名和数据库操作流程等。

详细说明:

先确认下身份:

indx.jpg


中国南方航空公司微信后台管理系统-URL:http://58.248.56.80/login.jsp 存在目录访问权限设置不严,导致整个管理平台的管理日志信息,用户线上交流信息全部泄露出来。包括用户机票订单号,用户联系方式,家庭地址等泄露。分析服务器日志 可以看到部分数据库表名 ,字段名和数据库操作流程等。
泄露感敏目录:

http://58.248.56.80/logs
Directory: /logs/
.donotdelete 0 bytes 2013-5-20 21:28:46
2014_07_01.stderrout.log 33318332 bytes 2014-7-2 7:57:07
2014_07_02.stderrout.log 24661438 bytes 2014-7-3 7:57:08
2014_07_03.stderrout.log 24358806 bytes 2014-7-4 7:59:27
2014_07_04.stderrout.log 42089449 bytes 2014-7-5 7:59:11
2014_07_05.stderrout.log 44173340 bytes 2014-7-6 7:59:52
2014_07_06.stderrout.log 60031572 bytes 2014-7-7 7:59:18
2014_07_07.stderrout.log 78911211 bytes 2014-7-8 7:59:27
2014_07_08.stderrout.log 105848214 bytes 2014-7-9 7:59:48
2014_07_09.stderrout.log 139030709 bytes 2014-7-10 7:59:49
2014_07_10.stderrout.log 166199900 bytes 2014-7-11 7:59:53
2014_07_11.stderrout.log 204386453 bytes 2014-7-12 7:59:57
2014_07_12.stderrout.log 211496820 bytes 2014-7-13 7:59:57
2014_07_13.stderrout.log 243823728 bytes 2014-7-14 7:57:06
2014_07_14.stderrout.log 224093612 bytes 2014-7-15 8:00:00
2014_07_15.stderrout.log 255109558 bytes 2014-7-16 7:59:49
2014_07_16.stderrout.log 292061820 bytes 2014-7-17 7:59:56
2014_07_17.stderrout.log 300224660 bytes 2014-7-18 7:59:58
2014_07_18.stderrout.log 346558783 bytes 2014-7-19 7:59:57
2014_07_19.stderrout.log 354995928 bytes 2014-7-20 7:59:51
2014_07_20.stderrout.log 381601433 bytes 2014-7-21 7:59:56
2014_07_21.stderrout.log 416976750 bytes 2014-7-22 7:59:58
2014_07_22.stderrout.log 416262956 bytes 2014-7-23 7:59:54
2014_07_23.stderrout.log 432930043 bytes 2014-7-24 7:59:48
2014_07_24.stderrout.log 2053373 bytes 2014-7-25 7:59:56
2014_07_24.stderrout.log.152147103 447112791 bytes 2014-7-24 23:21:41
2014_07_24.stderrout.log.153432350 4070897 bytes 2014-7-24 23:34:29
2014_07_24.stderrout.log.161734317 5460844 bytes 2014-7-25 0:17:31
2014_07_24.stderrout.log.170142656 2911833 bytes 2014-7-25 1:01:40
2014_07_24.stderrout.log.173421358 4141546 bytes 2014-7-25 1:34:18
2014_07_24.stderrout.log.182545070 3784615 bytes 2014-7-25 2:25:42
2014_07_24.stderrout.log.202227854 5352466 bytes 2014-7-25 4:22:24
2014_07_24.stderrout.log.205938480 2800385 bytes 2014-7-25 4:59:35
2014_07_24.stderrout.log.210123025 2534077 bytes 2014-7-25 5:01:21
2014_07_24.stderrout.log.230319419 3857198 bytes 2014-7-25 7:03:16
2014_07_25.stderrout.log 464852809 bytes 2014-7-26 7:59:37
2014_07_26.stderrout.log 491732770 bytes 2014-7-27 7:59:46
2014_07_27.stderrout.log 496848335 bytes 2014-7-28 7:59:53
2014_07_28.stderrout.log 547958194 bytes 2014-7-29 7:59:08
2014_07_29.stderrout.log 562320683 bytes 2014-7-30 7:59:56
2014_07_30.stderrout.log 611010039 bytes 2014-7-31 7:59:40
2014_07_31.stderrout.log 4074220 bytes 2014-8-1 7:59:57
2014_07_31.stderrout.log.070112479 285739138 bytes 2014-7-31 15:01:05
2014_07_31.stderrout.log.071156231 3621857 bytes 2014-7-31 15:11:53
2014_07_31.stderrout.log.081726923 44516461 bytes 2014-7-31 16:17:23
2014_07_31.stderrout.log.081835878 2384466 bytes 2014-7-31 16:18:33
2014_07_31.stderrout.log.083346411 4436036 bytes 2014-7-31 16:33:43
2014_07_31.stderrout.log.083607229 2607563 bytes 2014-7-31 16:36:04
2014_07_31.stderrout.log.084234433 8437857 bytes 2014-7-31 16:42:31
2014_07_31.stderrout.log.112027402 178494552 bytes 2014-7-31 19:20:24
2014_07_31.stderrout.log.121017235 58402549 bytes 2014-7-31 20:10:14
2014_07_31.stderrout.log.132130330 68395084 bytes 2014-7-31 21:21:27
2014_07_31.stderrout.log.133429607 17256551 bytes 2014-7-31 21:34:26
2014_07_31.stderrout.log.135753051 20708890 bytes 2014-7-31 21:57:50
2014_07_31.stderrout.log.140439210 8429608 bytes 2014-7-31 22:04:35
2014_07_31.stderrout.log.142841111 26446931 bytes 2014-7-31 22:28:38
2014_07_31.stderrout.log.153355495 33922184 bytes 2014-7-31 23:33:52
2014_07_31.stderrout.log.172140826 22589612 bytes 2014-8-1 1:21:37
2014_07_31.stderrout.log.173802712 2845662 bytes 2014-8-1 1:38:00
2014_07_31.stderrout.log.182550531 3311434 bytes 2014-8-1 2:25:47
2014_07_31.stderrout.log.183059542 2675091 bytes 2014-8-1 2:30:56
2014_07_31.stderrout.log.184154852 2990049 bytes 2014-8-1 2:41:52
2014_07_31.stderrout.log.184611162 2786500 bytes 2014-8-1 2:46:08
2014_07_31.stderrout.log.185512284 2860737 bytes 2014-8-1 2:55:09
2014_07_31.stderrout.log.193018260 3398763 bytes 2014-8-1 3:30:15
2014_07_31.stderrout.log.195001414 3204077 bytes 2014-8-1 3:49:58
2014_07_31.stderrout.log.195025685 489127 bytes 2014-8-1 3:50:23
2014_07_31.stderrout.log.201852087 3038416 bytes 2014-8-1 4:18:49
2014_08_01.stderrout.log 683983229 bytes 2014-8-2 7:59:57
2014_08_02.stderrout.log 688536156 bytes 2014-8-3 7:59:58
2014_08_03.stderrout.log 695882268 bytes 2014-8-4 7:59:35
2014_08_04.stderrout.log 40303565 bytes 2014-8-5 7:59:59
2014_08_04.stderrout.log.151207753 712693059 bytes 2014-8-4 23:12:02
2014_08_04.stderrout.log.151507677 2833952 bytes 2014-8-4 23:15:05
2014_08_05.stderrout.log 2191712 bytes 2014-8-6 7:59:59
2014_08_05.stderrout.log.045001329 252059173 bytes 2014-8-5 12:49:57
2014_08_05.stderrout.log.071636226 124479515 bytes 2014-8-5 15:16:34
2014_08_05.stderrout.log.232219607 423134158 bytes 2014-8-6 7:22:15
2014_08_06.stderrout.log 40261332 bytes 2014-8-7 7:59:59
2014_08_06.stderrout.log.023953685 164913572 bytes 2014-8-6 10:39:51
2014_08_06.stderrout.log.025340486 18134074 bytes 2014-8-6 10:53:37
2014_08_06.stderrout.log.025927508 3423229 bytes 2014-8-6 10:59:24
2014_08_06.stderrout.log.152107770 12651050 bytes 2014-8-6 11:17:55
2014_08_07.stderrout.log 6474964 bytes 2014-8-8 7:59:59
2014_08_07.stderrout.log.112714438 608527106 bytes 2014-8-7 19:27:10
2014_08_07.stderrout.log.114433984 14338129 bytes 2014-8-7 19:44:31
2014_08_07.stderrout.log.151632272 9793536 bytes 2014-8-7 23:14:42
2014_08_07.stderrout.log.152359223 3015785 bytes 2014-8-7 23:23:56
2014_08_08.stderrout.log 6930975 bytes 2014-8-9 7:59:52
2014_08_08.stderrout.log.011442868 16442482 bytes 2014-8-8 9:14:39
2014_08_08.stderrout.log.012326950 3252995 bytes 2014-8-8 9:23:24
2014_08_08.stderrout.log.025825577 13060478 bytes 2014-8-8 10:58:23
2014_08_08.stderrout.log.151625436 37742087 bytes 2014-8-8 23:16:22
2014_08_09.stderrout.log 51897960 bytes 2014-8-10 7:59:54
2014_08_10.stderrout.log 23434586 bytes 2014-8-10 10:55:52
WeixOssLogfile.log 9789910 bytes 2014-8-10 10:55:52
WeixOssLogfile.log.1 35285320 bytes 2014-8-10 8:26:04
WeixOssLogfile.log.10 35688137 bytes 2014-8-7 16:41:43
WeixOssLogfile.log.100 35520209 bytes 2014-8-2 17:34:24
WeixOssLogfile.log.11 35763271 bytes 2014-8-7 16:06:42
WeixOssLogfile.log.12 35669860 bytes 2014-8-7 15:31:48
WeixOssLogfile.log.13 35703167 bytes 2014-8-7 14:46:49
WeixOssLogfile.log.14 35508420 bytes 2014-8-7 14:11:39
WeixOssLogfile.log.15 36048244 bytes 2014-8-7 13:26:42
WeixOssLogfile.log.16 35389080 bytes 2014-8-7 12:41:40
WeixOssLogfile.log.17 36241165 bytes 2014-8-7 11:51:44
WeixOssLogfile.log.18 35552876 bytes 2014-8-7 11:11:48
WeixOssLogfile.log.19 36529305 bytes 2014-8-7 10:26:40
WeixOssLogfile.log.2 35160974 bytes 2014-8-9 15:04:11
WeixOssLogfile.log.20 35516877 bytes 2014-8-7 9:41:46
WeixOssLogfile.log.21 36827788 bytes 2014-8-7 9:06:45
WeixOssLogfile.log.22 36119471 bytes 2014-8-7 8:21:46
WeixOssLogfile.log.23 35524062 bytes 2014-8-6 23:56:49
WeixOssLogfile.log.24 32584210 bytes 2014-8-6 11:17:37
WeixOssLogfile.log.25 35323937 bytes 2014-8-6 10:39:32
WeixOssLogfile.log.26 36064638 bytes 2014-8-6 10:02:53
WeixOssLogfile.log.27 36003925 bytes 2014-8-6 9:17:59
WeixOssLogfile.log.28 35755769 bytes 2014-8-6 8:32:58
WeixOssLogfile.log.29 32572121 bytes 2014-8-6 8:03:09
WeixOssLogfile.log.3 34349087 bytes 2014-8-8 23:02:03
WeixOssLogfile.log.30 35519053 bytes 2014-8-5 23:27:14
WeixOssLogfile.log.31 35716482 bytes 2014-8-5 22:42:11
WeixOssLogfile.log.32 35821502 bytes 2014-8-5 21:57:09
WeixOssLogfile.log.33 35554777 bytes 2014-8-5 21:17:05
WeixOssLogfile.log.34 35593534 bytes 2014-8-5 20:27:12
WeixOssLogfile.log.35 35945168 bytes 2014-8-5 19:42:08
WeixOssLogfile.log.36 35611491 bytes 2014-8-5 19:07:05
WeixOssLogfile.log.37 35636424 bytes 2014-8-5 18:17:13
WeixOssLogfile.log.38 35828049 bytes 2014-8-5 17:32:09
WeixOssLogfile.log.39 35501623 bytes 2014-8-5 16:45:06
WeixOssLogfile.log.4 31931222 bytes 2014-8-8 10:58:03
WeixOssLogfile.log.40 35967958 bytes 2014-8-5 16:07:08
WeixOssLogfile.log.41 32241339 bytes 2014-8-5 15:22:24
WeixOssLogfile.log.42 35486076 bytes 2014-8-5 14:51:01
WeixOssLogfile.log.43 35635930 bytes 2014-8-5 14:05:47
WeixOssLogfile.log.44 34363229 bytes 2014-8-5 13:17:23
WeixOssLogfile.log.45 36488924 bytes 2014-8-5 12:40:42
WeixOssLogfile.log.46 35545768 bytes 2014-8-5 11:55:46
WeixOssLogfile.log.47 36672849 bytes 2014-8-5 11:15:39
WeixOssLogfile.log.48 36309663 bytes 2014-8-5 10:30:42
WeixOssLogfile.log.49 35451088 bytes 2014-8-5 9:45:39
WeixOssLogfile.log.5 31489236 bytes 2014-8-8 0:20:41
WeixOssLogfile.log.50 36252323 bytes 2014-8-5 9:05:42
WeixOssLogfile.log.51 35929422 bytes 2014-8-5 8:20:44
WeixOssLogfile.log.52 36020131 bytes 2014-8-4 23:50:40
WeixOssLogfile.log.53 35761453 bytes 2014-8-4 23:09:30
WeixOssLogfile.log.54 35447559 bytes 2014-8-4 22:24:23
WeixOssLogfile.log.55 36123613 bytes 2014-8-4 21:34:24
WeixOssLogfile.log.56 35716505 bytes 2014-8-4 20:49:25
WeixOssLogfile.log.57 35723025 bytes 2014-8-4 20:04:25
WeixOssLogfile.log.58 35675240 bytes 2014-8-4 19:14:29
WeixOssLogfile.log.59 35869374 bytes 2014-8-4 18:29:25
WeixOssLogfile.log.6 35202929 bytes 2014-8-7 19:26:46
WeixOssLogfile.log.60 36184103 bytes 2014-8-4 17:39:28
WeixOssLogfile.log.61 35714201 bytes 2014-8-4 16:59:25
WeixOssLogfile.log.62 35946466 bytes 2014-8-4 16:14:25
WeixOssLogfile.log.63 35367442 bytes 2014-8-4 15:29:24
WeixOssLogfile.log.64 35834758 bytes 2014-8-4 14:39:29
WeixOssLogfile.log.65 35441891 bytes 2014-8-4 13:54:23
WeixOssLogfile.log.66 35816835 bytes 2014-8-4 13:04:28
WeixOssLogfile.log.67 35436207 bytes 2014-8-4 12:14:25
WeixOssLogfile.log.68 35830580 bytes 2014-8-4 11:29:29
WeixOssLogfile.log.69 35402202 bytes 2014-8-4 10:44:24
WeixOssLogfile.log.7 35585954 bytes 2014-8-7 18:51:39
WeixOssLogfile.log.70 36091531 bytes 2014-8-4 9:59:28
WeixOssLogfile.log.71 36095683 bytes 2014-8-4 9:14:28
WeixOssLogfile.log.72 35864830 bytes 2014-8-4 8:29:32
WeixOssLogfile.log.73 35657867 bytes 2014-8-3 23:59:28
WeixOssLogfile.log.74 35798686 bytes 2014-8-3 23:09:28
WeixOssLogfile.log.75 35704918 bytes 2014-8-3 22:09:32
WeixOssLogfile.log.76 35478426 bytes 2014-8-3 21:29:25
WeixOssLogfile.log.77 35644008 bytes 2014-8-3 20:29:29
WeixOssLogfile.log.78 36159455 bytes 2014-8-3 19:44:24
WeixOssLogfile.log.79 36377527 bytes 2014-8-3 18:54:26
WeixOssLogfile.log.8 36083768 bytes 2014-8-7 18:11:42
WeixOssLogfile.log.80 35717552 bytes 2014-8-3 17:59:27
WeixOssLogfile.log.81 35706884 bytes 2014-8-3 17:04:30
WeixOssLogfile.log.82 35585513 bytes 2014-8-3 16:19:31
WeixOssLogfile.log.83 35775402 bytes 2014-8-3 15:34:25
WeixOssLogfile.log.84 35699849 bytes 2014-8-3 14:44:25
WeixOssLogfile.log.85 36312213 bytes 2014-8-3 13:59:25
WeixOssLogfile.log.86 35626652 bytes 2014-8-3 13:09:25
WeixOssLogfile.log.87 35815934 bytes 2014-8-3 12:14:25
WeixOssLogfile.log.88 35667596 bytes 2014-8-3 11:19:24
WeixOssLogfile.log.89 35425536 bytes 2014-8-3 10:34:23
WeixOssLogfile.log.9 35757783 bytes 2014-8-7 17:26:44
WeixOssLogfile.log.90 36122727 bytes 2014-8-3 9:39:28
WeixOssLogfile.log.91 36035913 bytes 2014-8-3 8:53:58
WeixOssLogfile.log.92 36020097 bytes 2014-8-3 8:09:23
WeixOssLogfile.log.93 35598347 bytes 2014-8-2 23:29:23
WeixOssLogfile.log.94 35520838 bytes 2014-8-2 22:34:30
WeixOssLogfile.log.95 35875792 bytes 2014-8-2 21:49:25
WeixOssLogfile.log.96 35580931 bytes 2014-8-2 20:54:32
WeixOssLogfile.log.97 35769329 bytes 2014-8-2 20:04:29
WeixOssLogfile.log.98 35717823 bytes 2014-8-2 19:14:23
WeixOssLogfile.log.99 35678240 bytes 2014-8-2 18:24:26
mcc-web-dequeue.log 30930096 bytes 2014-8-10 10:55:53
mcc-web-dequeue.log.2014-07-24 1916719 bytes 2014-7-24 23:59:57
mcc-web-dequeue.log.2014-07-25 71781323 bytes 2014-7-25 23:59:57
mcc-web-dequeue.log.2014-07-26 68766544 bytes 2014-7-26 23:59:57
mcc-web-dequeue.log.2014-07-27 68766246 bytes 2014-7-27 23:59:57
mcc-web-dequeue.log.2014-07-28 68698181 bytes 2014-7-28 23:59:57
mcc-web-dequeue.log.2014-07-29 68707133 bytes 2014-7-29 23:59:57
mcc-web-dequeue.log.2014-07-30 68709072 bytes 2014-7-30 23:59:57
mcc-web-dequeue.log.2014-07-31 61562894 bytes 2014-7-31 23:59:59
mcc-web-dequeue.log.2014-08-01 47366004 bytes 2014-8-1 23:59:59
mcc-web-dequeue.log.2014-08-02 49083401 bytes 2014-8-2 23:59:59
mcc-web-dequeue.log.2014-08-03 49085025 bytes 2014-8-3 23:59:59
mcc-web-dequeue.log.2014-08-04 49117466 bytes 2014-8-4 23:59:58
mcc-web-dequeue.log.2014-08-05 48470669 bytes 2014-8-5 23:59:59
mcc-web-dequeue.log.2014-08-06 22523005 bytes 2014-8-6 23:59:56
mcc-web-dequeue.log.2014-08-07 67465431 bytes 2014-8-7 23:59:58
mcc-web-dequeue.log.2014-08-08 65961721 bytes 2014-8-8 23:59:58
mcc-web-dequeue.log.2014-08-09 67950462 bytes 2014-8-9 23:59:56
mcc-web-enqueue.log 98666 bytes 2014-8-10 10:52:31
mcc-web-enqueue.log.2014-07-24 0 bytes 2014-7-24 23:22:41
mcc-web-enqueue.log.2014-07-25 744595 bytes 2014-7-25 18:53:17
mcc-web-enqueue.log.2014-07-26 2550 bytes 2014-7-26 15:55:39
mcc-web-enqueue.log.2014-07-27 3528 bytes 2014-7-27 22:24:34
mcc-web-enqueue.log.2014-07-28 42478 bytes 2014-7-28 17:34:24
mcc-web-enqueue.log.2014-07-29 50270 bytes 2014-7-29 20:02:25
mcc-web-enqueue.log.2014-07-30 92691 bytes 2014-7-30 22:44:16
mcc-web-enqueue.log.2014-07-31 169847 bytes 2014-7-31 23:56:43
mcc-web-enqueue.log.2014-08-01 369872 bytes 2014-8-1 23:19:34
mcc-web-enqueue.log.2014-08-02 113799 bytes 2014-8-2 23:23:30
mcc-web-enqueue.log.2014-08-03 119985 bytes 2014-8-3 23:37:34
mcc-web-enqueue.log.2014-08-04 429753 bytes 2014-8-4 23:31:07
mcc-web-enqueue.log.2014-08-05 724770 bytes 2014-8-5 23:55:40
mcc-web-enqueue.log.2014-08-06 273510 bytes 2014-8-6 23:53:49
mcc-web-enqueue.log.2014-08-07 500144 bytes 2014-8-7 22:01:56
mcc-web-enqueue.log.2014-08-08 489079 bytes 2014-8-8 23:56:18
mcc-web-enqueue.log.2014-08-09 430283 bytes 2014-8-9 23:00:42
mcc-web.log 95040 bytes 2014-8-10 10:53:41
mcc-web.log.2014-07-24 116823 bytes 2014-7-24 23:35:38
mcc-web.log.2014-07-25 3805243 bytes 2014-7-25 18:27:51
mcc-web.log.2014-07-28 332408 bytes 2014-7-28 20:14:04
mcc-web.log.2014-07-29 341757 bytes 2014-7-29 20:04:08
mcc-web.log.2014-07-30 431357 bytes 2014-7-30 22:47:15
mcc-web.log.2014-07-31 2560681 bytes 2014-7-31 23:53:17
mcc-web.log.2014-08-01 1705176 bytes 2014-8-1 16:20:23
mcc-web.log.2014-08-02 147113 bytes 2014-8-2 16:26:15
mcc-web.log.2014-08-03 503991 bytes 2014-8-3 21:18:17
mcc-web.log.2014-08-04 652629 bytes 2014-8-4 23:59:47
mcc-web.log.2014-08-05 868139 bytes 2014-8-5 22:51:37
mcc-web.log.2014-08-06 9807513 bytes 2014-8-6 23:57:02
mcc-web.log.2014-08-07 1130524 bytes 2014-8-7 23:41:22
mcc-web.log.2014-08-08 5484495 bytes 2014-8-8 23:59:48
mcc-web.log.2014-08-09 1093878 bytes 2014-8-9 23:31:01
yxWeb.log 1568164 bytes 2013-9-7 20:35:15


还有这个http://58.248.56.79/
Directory: /cswx/
META-INF/ 4096 bytes 2014-8-7 19:58:31
WEB-INF/ 4096 bytes 2014-8-7 19:58:31
css/ 4096 bytes 2014-8-7 19:58:31
fakeseatmap.html 2908 bytes 2013-12-4 18:19:42
html/ 4096 bytes 2014-8-7 19:58:31
images/ 4096 bytes 2014-8-7 19:58:31
index.jsp 159 bytes 2013-12-4 18:19:42
js/ 4096 bytes 2014-8-7 19:58:31
jsp/ 4096 bytes 2014-8-7 19:58:31
test.css 128 bytes 2013-12-4 18:19:42
PS:不知道为啥传图片有问题了,就酱紫来看吧!
这里只是截图证明问题存在,要说危害,有了用户的聊天纪录只要耐下心去翻日志翻到用户身份证号,银行卡号什么的也不是不可能。也可以去http://m.csair.com/上面给用户恶搞订机票啊 办理其他业务什么的。

漏洞证明:

看两个好玩的:

移动触屏.jpg


2.jpg


再来一个:
这个认证还没有失效-对,是今天早上的。。日志还是新鲜出炉的!!

微信图片.jpg


来看看聊天纪录:

信息泄露.jpg


微信.jpg


来看看微信数据库表和字段信息

table.jpg


修复方案:

日志文件不要放在这么明显的地方,加大文件目录权限设置。

版权声明:转载请注明来源 cf_hb@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2014-08-11 09:05

厂商回复:

多谢白帽子的辛勤劳动

最新状态:

暂无


漏洞评价:

评论