A sub-station of jixiang life (logical error, sensitive information leakage, SQL injection) Vulnerability

A sub-station of jixiang life (logical error, sensitive information leakage, SQL injection) Vulnerability

A sub-station of jixiang life (logical error, sensitive information leakage, SQL injection) Vulnerability

Auspicious Life Insurance System http://weixin.jxlife.com.cn/jxlife/jsp/traffic_mobile_index.jsp? FromUserName =

Question 1 # packet capture and replay can be used to send arbitrary messages
POST http://weixin.jxlife.com.cn/jxlife/jsp/getPhoneCode HTTP/1.1
Accept: application/json, text/javascript, */*; q = 0.01
Content-Type: application/x-www-form-urlencoded; charset = UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://weixin.jxlife.com.cn/jxlife/jsp/traffic_mobile_index.jsp? FromUserName =
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: weixin.jxlife.com.cn
Content-Length: 22
Connection: Keep-Alive
Pragma: no-cache
Cookie: 229667067 = 0; JSESSIONID = D93E48BFF14BB07ECA416A5D0CACCF6B; CNZZDATA1254189807 = 1614033562-1436270012-% 7C1436270012
AppntPhone = the phone number you specified
In about one minute, I used replay to send 11 messages to myself. Of course, there are more.

2 # system design defects. The text message verification code is directly returned to the user in plaintext, resulting in any risk.

I got a free insurance for myself with the 13888888888 number.

3 # SQL Injection
Http://weixin.jxlife.com.cn/jxlife/jsp/trafficDetailQuery.page? ContNo = 900004299434 & way = & QAppntIDNo = 110101198808085638 & QAppntPhone = 13888888888
Parameter: ContNo (GET)
Type: boolean-based blind
Title: AND boolean-based blind-WHERE or HAVING clause


Table LRPOL


Time relationship, not one by one, slow

Solution:

SQL Injection: modify the program and parameterize the query text message for arbitrary sending: the background program determines the number of sending times and interval, and adds the blacklist to delete the front-end Verification Code return value.