A vulnerability in the GPS Positioning System of Ping An can leak a large amount of information (user information/order information/real-time vehicle location)

A vulnerability in the GPS Positioning System of Ping An can leak a large amount of information (user information/order information/real-time vehicle location)

Detailed description:

Http://gps.lnwin.com/

Account: test

Password 123456

After logging on, I found that this is a demo account with no permissions. Skip and open

Http://gps.lnwin.com/Server/UserServer.asmx

A series of WebService methods can be executed without authorization.

View user orders beyond authorization

View sub-user information beyond authorization

Most users use 123456 passwords.

Ruijin Fire Protection Login

Ping An xing Logon

China South logistics Login