当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0115789

漏洞标题: 游惠宝登陆接口设计不当可撞库

相关厂商:uhuibao.com

漏洞作者: cisk

提交时间:2015-05-25 15:51

修复时间:2015-07-11 11:24

公开时间:2015-07-11 11:24

漏洞类型:设计缺陷/逻辑错误

危害等级:高

自评Rank:12

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-25: 细节已通知厂商并且等待厂商处理中
2015-05-27: 厂商已经确认,细节仅向厂商公开
2015-06-06: 细节向核心白帽子及相关领域专家公开
2015-06-16: 细节向普通白帽子公开
2015-06-26: 细节向实习白帽子公开
2015-07-11: 细节向公众公开

简要描述:

游惠宝登陆接口设计不当可撞库

详细说明:

登陆接口:http://uhuibao.com/index.php?s=/

QQ图片20150523221639.png


然后抓包 都是明文输出

QQ图片20150523220604.png


遍历一些用户

QQ图片20150523220402.png


<code>
wx311000

wx311001

wx311002

wx311003

wx311005

wx311006

wx311007

308794652

wx311009

wx311010

wx311011

wx311012

alipay311013

漂洋过海

wx311015

wx311016

wx311017

wx311018

wx311019

alipay311020

wx311021

皮皮蛋

wx311023

wx311024

wx311025

qqwb_88068327

wx311027



wx311029

wx311030

wx311031

wx311032

wx311033

iiiooo666

wx311035

wx311036

qqwb_49764315

wx311038

wx311039

Daisy晓倩

wx311041

wx311042

wx311043

欢子

wx311045

celine1761

wx311047

wx311048

泊瑞莱面膜-玲子
wx311050

13430868948

wx311052

wx311053

wx311054

wx311055

wx311056

wx311057

wx311058

wx311059

wx311060

wx311061

wx311062

wx311063

wx311064

wx311065

wx311066

wx311067

wx311068

wx311069

lala

wx311071

wx311072

小丸bb

wx311074

alipay311075

wx311076

wx311077

Neala✨香港代购??饰品批发

wx311079

wx311080

wx311081

wx311082

wx311083

alipay311084

袁韵

alipay311086

bonnieBon

wx311088

wx311089

wx311090

wx311091

alipay311092

wx311093

hoiyee

wx311095

水月

cherry

wx311098

心情靓靓

qqwb_109576185

wx311101

alipay311102

wx311103

2b
<
wx311105

wx311106

wx311107

alipay311108

wx311109

alipay311110

wx311111

wx311112

wx311113

chunse99

wx311115

wx311116

wx311117

hwongyintim

13824353301

wx311120

wx311121

wx311122

wx311123

wx311124

wx311125

wx311126

tiffany5187

AA杨大人

wx311129

M a t hie u
alipay311131

wx311132

wx311133

wx311134

liya_ye

alipay311136

wx311137

wx311138

wx311139

wx311140

</d
wx311142

wx311143

wx311144

wx311145

wx311146

13925745222



wx311149

wx311150

alipay311151

alipay311152

alipay311153

wx311154

wx311155

wx311156

wx311157

李樹欣✨

alipay311159

wx311160

wx311161

哎哟哥哥hi你好
wx311163

wx311164

wx311165

wx311166

wx311167

烁烁

wx311169

wx311170

wx311171

太阳女神

wx311173

alipay311174

wx311175

alipay311176

wx311177

wx311178

wx311179

wx311180

alipay311181

alipay311182

13632394526

wx311184

alipay311185

wx311186

alipay311187

wx311188

wx311189

wx311190

wx311191

朱淑倩

alipay311193

wx311194

wx311195

alipay311196

wx311197

wx311198

wx311199

alipay311200

wx311201

qqwb_16976184

wx311203

wx311204

wx311205

EvanYin

wx311207

wx311208

wx311209

wx311210

wx311211

wx311212

wx311213

wx311214

wx311215

wx311216

wx311217

wx311218

萍萍

wx311220

13632311411

wx311222

wx311223

wx311224

wx311225

garia

wx311227

18823775421

wx311229



wx311231

wx311232

wx311233

wx311234

wx311235

wx311236

wx311237

wx311238

wx311239

wx311240

wx311241

wx311242
wx311244

花花

wx311246

wx311247

wx311248

qqwb_79443904

Ms li

wx311251

wx311252

alipay311253

Million

yifengx

wx311256

alipay311257

wx311258

wx311259

hfjw99

wx311261

wx311262

wx311263

sina_85745565

wx311265

wx311266

qqwb_13041873

qqwb_90710423

wx311269

Stasfiem

alipay311271

wx311272

wx311273

wx311274

alipay311275

wx311276

alipay311277

wx311278

wx311279

wx311280

wx311281

爱的马德里

Ly-y

wx311284

wx311285

wx311286

石清

wx311288

wx311289

wx311290

wx311291

wx311292

wx311293

wx311294

sina_19168663

wx311296

wx311297

wx311298

wx311299

wx311300

wx311301

wx311302

张君碧-HK代购

wx311304

wx311305

wx311306

wx311307

alipay311308

wx311309

qxqiong

wx311311

wx311312

wx311313

wx311314

wx311315

wx311316

wx311317

wx311318

wx311319

wx311320

wx311321

Christy

wx311323

wx311324

wx311325

wx311326

wx311327

wx311328

wx311329

wx311330

wx311331

壹生随缘

凌璐

wx311334

wx311335

wx311336

wx311337

wx311338

木子

wx311340

wx311341

wx311342

wx311343

wx311344

wx311345

KIM

wx311347

qqwb_46067276

YIXUNYANG

wx311350

Crystal LN

alipay311352

only

果果

wx311355

wx311356

康梦北鼻

wx311358

徐楚玲兒??

wx311360

wx311361

wx311362

希尔瓦娜斯

张尧羽

wx311365

wx311366

wx311367

wx311368

蓝蓝

李慕子

wx311371

wx311372

wx311373

wx311374

wx311375

wx311376

wx311377

wx311378

wx311379

wx311380

wx311381

wx311382

wx311383

甜心斑比

wx311385

wx311386

wx311387

alipay311388

wx311389

wx311390

wx311391

xoxo007

wx311393

wx311394

qqwb_100326420

wx311396

云朵上的?我是云朵上的鱼

赵静

sina_86773146

wx311400

后然

wx311402

wx311403

alipay311404

wx311405

驿路上

wx311407

wx311408

wx311409

wx311410

wx311411

wx311412

teresa

wx311414

wx311415

wx311416

wx311417

wx311418

wx311419

Erica

漏洞证明:

QQ图片20150523220604.png


QQ图片20150523220402.png


QQ图片20150523220418.png


修复方案:

增强验证

版权声明:转载请注明来源 cisk@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:6

确认时间:2015-05-27 11:22

厂商回复:

谢谢,正在安排处理!

最新状态:

暂无


漏洞评价:

评论