Xuehesi (good future) can obtain the highest permissions of the group's core online systems (covering the business systems in 38 cities and 3 Management Systems)

Xuehesi (good future) can obtain the highest permissions of the group's core online systems (covering the business systems in 38 cities and 3 Management Systems)

The maximum management permission of the system is obtained due to a function defect. The business system and three management systems in 38 cities can be controlled.

 

#1. Collect information

Found employee login page: http://zhiyinlou.com/Cas/login
 

Get administrator username: qx@xueersi.com
 

#2. Functional Defects in password retrieval

The parameters of the retrieval step are directly placed in the url and are not verified. The parameter is directly changed to step 3, which can cause skipping the authentication identity and resetting the password.
 

Password Reset for administrator qx@xueersi.com to test123.
 

#3. logon successful

The Administrator's permissions can control the training and optimization business systems of 38 cities and 3 Management Systems (New BI system, online school learning card system, and CRM Management System ).
 

In the training business system, you can manage the class, teacher, finance, discount, documents, home and school, evaluation, experience, questions, permissions, handouts, and students of the student and thinking group in the city, data on trainees, teachers, and finance can be modified and a large amount of training materials can be leaked.
 

During the actual test, the system requires that the plug-in be installed and the MAC address be bound. It proves that the purpose of the hazard has been achieved, so it is not in-depth (this authentication for the core system administrator still reflects a strong security awareness, it is worth learning .)

The CRM management system can manage subjects (lectures), call and service centers, sales, customers, and reports without secondary identity verification.
 

#4. Others

Other background addresses from Google: http://www.zhiyinlou.com/admin/SysUsers/login
 

 

Solution:

#1. Modify the logic of password retrieval.

#2. Key systems shield search engine crawlers.

#3. I'm sorry to reset the administrator password. ● reset ●

#4. If you haven't downloaded any information, ask for 20 rank, don't get fired, and ask for a gift ~ (Student)