当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0160021

漏洞标题：中意财产保险有限公司Java反序列化命令执行（Root）

相关厂商：中意财产保险有限公司

漏洞作者： 牛 小 帅

提交时间：2015-12-11 13:34

修复时间：2016-01-28 17:10

公开时间：2016-01-28 17:10

漏洞类型：命令执行

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-11： 细节已通知厂商并且等待厂商处理中
2015-12-15： 厂商已经确认，细节仅向厂商公开
2015-12-25： 细节向核心白帽子及相关领域专家公开
2016-01-04： 细节向普通白帽子公开
2016-01-14： 细节向实习白帽子公开
2016-01-28： 细节向公众公开

简要描述：

中意财产保险有限公司Java反序列化命令执行（Root）

详细说明：

随便测试一个地址，发现是jboss应用，乱提交字符让它报错

http://**.**.**.**/EbsWeb/myInsurance/zhongyiCarQuery.jsp


$2B$~K_ZEZKE(KMWNE2PQ{R.png


上工具

$2$C}M468K0~75E%]~PL~BN.png


bond0     Link encap:Ethernet  HWaddr 00:21:5E:74:51:08  
          inet addr:**.**.**.**  Bcast:**.**.**.**  Mask:**.**.**.**
          inet6 addr: fe80::221:5eff:fe74:5108/64 Scope:Link
          UP BROADCAST RUNNING MASTER MULTICAST  MTU:1500  Metric:1
          RX packets:169746533 errors:0 dropped:0 overruns:0 frame:0
          TX packets:227658387 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:31666185914 (29.4 GiB)  TX bytes:114366439542 (106.5 GiB)
eth0      Link encap:Ethernet  HWaddr 00:21:5E:74:51:08  
          inet addr:**.**.**.**  Bcast:**.**.**.**  Mask:**.**.**.**
          UP BROADCAST RUNNING SLAVE MULTICAST  MTU:1500  Metric:1
          RX packets:169746533 errors:0 dropped:0 overruns:0 frame:0
          TX packets:227658387 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:31666185914 (29.4 GiB)  TX bytes:114366439542 (106.5 GiB)
          Interrupt:169 Memory:ce000000-ce012100 
lo        Link encap:Local Loopback  
          inet addr:**.**.**.**  Mask:**.**.**.**
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:117046911 errors:0 dropped:0 overruns:0 frame:0
          TX packets:117046911 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:119593802573 (111.3 GiB)  TX bytes:119593802573 (111.3 GiB)


root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
netdump:x:34:34:Network Crash Dump user:/var/crash:/bin/bash
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
squid:x:23:23::/var/spool/squid:/sbin/nologin
webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
gdm:x:42:42::/var/gdm:/sbin/nologin
canna:x:39:39:Canna Service User:/var/lib/canna:/sbin/nologin
wnn:x:49:49:Wnn Input Server:/var/lib/wnn:/sbin/nologin
oracle:x:500:500::/home/oracle:/bin/bash


目测全部文件可读

classpath.sh
conf
conf.jsp
css.jsp
D:\workareaX\EBS\SOURCECODE\src\client\logs\business_log.log
D:\workareaX\EBS\SOURCECODE\src\client\logs\dispatcher.log
D:\workareaX\EBS\SOURCECODE\src\client\logs\dispatcher.log.2012-01-16
D:\workareaX\EBS\SOURCECODE\src\client\logs\dispatcher.log.2015-08-10
D:\workareaX\EBS\SOURCECODE\src\client\logs\epicclog.log
D:\workareaX\EBS\SOURCECODE\src\client\logs\generalCard.log
D:\workareaX\EBS\SOURCECODE\src\client\logs\receiver.log
D:\workareaX\EBS\SOURCECODE\src\client\logs\sms.log
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-01-16
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-01-17
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-01-23
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-01-31
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-02-01
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-03-09
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-03-29
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-04-05
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-04-06
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-04-09
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-04-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-04-16
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-04-21
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-04-26
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-04-27
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-04-28
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-05-03
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-05-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-05-21
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-05-26
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-05-30
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-06-22
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-06-26
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-07-02
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-07-05
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-07-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-07-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-08-14
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-08-18
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-09-19
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-10-01
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-10-08
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-10-09
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-10-11
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-10-22
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-10-23
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-10-29
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-11-03
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-11-04
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-11-07
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-11-08
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-11-12
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-11-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-12-01
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-12-07
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-12-12
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-12-23
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-12-25
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2012-12-31
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-01-04
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-02-20
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-03-11
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-03-27
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-04-02
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-04-18
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-05-26
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-05-30
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-06-08
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-06-11
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-06-20
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-06-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-07-02
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-07-10
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-07-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-08-14
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-08-22
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-08-26
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-09-17
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-09-18
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-09-22
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-09-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-09-29
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-10-09
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-10-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-10-30
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-11-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-11-25
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-12-10
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-12-20
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2013-12-23
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-01-03
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-01-06
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-02-12
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-02-20
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-03-12
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-04-03
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-04-08
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-04-09
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-04-11
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-04-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-04-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-05-08
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-05-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-05-19
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-06-11
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-07-02
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-07-03
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-07-04
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-07-07
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-07-08
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-07-09
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-07-16
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-07-28
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-08-05
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-08-14
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-08-28
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-08-31
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-09-16
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-10-09
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-10-10
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-10-23
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-10-30
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-10-31
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-11-11
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-11-12
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-11-14
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-11-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-11-17
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-11-22
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-12-04
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-12-08
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-12-09
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-12-10
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2014-12-14
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-01-04
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-01-13
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-01-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-02-06
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-02-07
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-03-04
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-03-11
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-03-17
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-04-07
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-04-08
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-04-09
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-04-21
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-04-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-05-06
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-05-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-05-22
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-05-25
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-05-26
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-05-28
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-06-01
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-06-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-06-19
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-06-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-06-30
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-07-01
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-07-02
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-07-08
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-07-09
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-07-22
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-07-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-07-26
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-07-28
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-07-29
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-08-06
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-08-10
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-08-11
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-08-14
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-08-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-08-17
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-08-19
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-08-22
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-08-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-08-27
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-09-13
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-09-15
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-10-11
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-10-12
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-10-14
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-10-17
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-10-19
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-10-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-11-14
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-11-18
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-11-23
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-11-24
D:\workareaX\EBS\SOURCECODE\src\client\logs\system_log.log.2015-11-26
jboss_init_hpux.sh
jboss_init_redhat.sh
jboss_init_suse.sh
nohup.out
probe.bat
probe.sh
run.bat
run.conf
run.jar
run.sh
shutdown.bat
shutdown.jar
shutdown.sh
twiddle.bat
twiddle.jar
twiddle.sh
velocity.log
wsconsume.bat
wsconsume.sh
wsprovide.bat
wsprovide.sh
wsrunclient.bat
wsrunclient.sh
wstools.bat
wstools.sh


漏洞证明：

修复方案：

版权声明：转载请注明来源 牛 小 帅@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：9

确认时间：2015-12-15 13:52

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT向保险行业信息化主管部门通报，由其后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评价