edusrc漏洞挖掘第八天｜我一眼就看出你这响应不对劲

POST /ums/ums/getRole HTTP/1.1Host: user.xxxxxxx.sjtu.edu.cnAccept: application/json, text/plain, */*Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9Content-Length: 0Origin: https://user.xxxxxxx.sjtu.edu.cnReferer: https://user.xxxxxxx.sjtu.edu.cn/ums/user/index.htmlSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="112", "Google Chrome";v="112", "Not:A-Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "macOS"

HTTP/1.1 200 OKAccess-Control-Allow-Credentials: trueAccess-Control-Allow-Credentials: falseAccess-Control-Allow-Headers: X-Requested-With,Content-TypeAccess-Control-Allow-Methods: PUT,POST,GET,DELETE,OPTIONSAccess-Control-Allow-Origin: https://user.xxxxxxx.sjtu.edu.cnConnection: keep-aliveContent-Type: application/json; charset=utf-8Date: Tue, 07 Feb 2023 10:40:42 GMTEtag: W/"4d4-d17bqK52VNY2JQ4ODTzgbhOimVQ"Server: nginxStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINX-Nginx-Debug-Variables: host:user.xxxxxxx.sjtu.edu.cn,request_uri:/ums/ums/getRole,X-Powered-By: ExpressX-Xss-Protection: 1; mode=blockContent-Length: 2721
{    "code": 100,    "msg": "请求成功",    "extend": {        "returnMsg": [            {                "roleId": "10",                "name": "用户联络员",                "energyValid": "0",                "imsValid": "0",                "meetingValid": "1",                "visitorValid": "1",                "limsValid": "1",                "param01": null,                "param02": "1",                "param03": "3"            },            {                "roleId": "11",                "name": "运行管理员",                "energyValid": "1",                "imsValid": "1",                "meetingValid": "1",                "visitorValid": "1",                "limsValid": "1",                "param01": null,                "param02": "2",                "param03": "1"            },            {                "roleId": "13",                "name": "系统管理员",                "energyValid": "1",                "imsValid": "1",                "meetingValid": "1",                "visitorValid": "1",                "limsValid": "1",                "param01": null,                "param02": "3",                "param03": "1"            },            {                "roleId": "3",                "name": "物业管理员",                "energyValid": "1",                "imsValid": "0",                "meetingValid": "1",                "visitorValid": "1",                "limsValid": "1",                "param01": null,                "param02": "4",                "param03": "2"            },            {                "roleId": "7",                "name": "全校老师",                "energyValid": "0",                "imsValid": "0",                "meetingValid": "1",                "visitorValid": "0",                "limsValid": "0",                "param01": null,                "param02": "5",                "param03": "1"            },            {                "roleId": "8",                "name": "全校学生",                "energyValid": "0",                "imsValid": "0",                "meetingValid": "0",                "visitorValid": "0",                "limsValid": "0",                "param01": null,                "param02": "6",                "param03": "1"            },            {                "roleId": "9",                "name": "用户",                "energyValid": "0",                "imsValid": "0",                "meetingValid": "1",                "visitorValid": "1",                "limsValid": "1",                "param01": null,                "param02": "7",                "param03": "3"            }        ]    }}