Packaging and submission of Dangdang design defects for E-Commerce Security (affecting 32 million orders, customer contact addresses, etc)

Packaging and submission of Dangdang design defects for E-Commerce Security (affecting 32 million orders, customer contact addresses, etc)

RT

Log On from login.dangdang.com. It should be Dangdang...

1,

URL：http://huishou.dangdang.com/

When logging on to the Dangdang unified login port, it should be Dangdang's website.

2. view a large number of mobile phone valuation order information
 

Traverse parameter c
 

 

You can see the number, price, and payment method of collection.
 

3. The Receiving address is unauthorized, and the receiving address is CSRF.

First, CSRF
 

POC:

 

Verify
 

Delete unauthorized contact information

It is known that the id of a contact in this account is 2583. log on to another account and delete the contact with excessive permissions.
 

Modify id
 

Deleted
 

View other contact information

The submit order is to modify parameter
 

Proof
 

Pay attention to the contact information and see the contact information of others.

4. Order revocation beyond authorization

Log on to account A and click Cancel order
 

 

Change to the order number in account B
 

Order canceled
 

Solution:

Suggestion:

1. Verify the permission if the permission is denied

2. CSRF, verify referer, and add token