<100 subscribers
某日闲来无事，扫描到了一个科研系统，第一次尝试爆破，发现没有验证码，且密码大部分都是123456，相当于把企业信息全部泄露在外，曝光给了所有人。
于是将此信息报告给了涉事公司，公司反应还是比较迅速的。
不过效果吗，就感觉原来是完全裸露，现在加了一把锁，锁是很好看，但是钥匙就放在锁的旁边，要么就是这技术糊弄了公司，要么就是幼儿园水平。
入侵过程非常简单：打开首页地址如下：
然后根据加载的JS就可以拿到其所有的接口地址，根据其名字就能知道大概含义，产品，员工、订单、审核、供应商全都直接可以拿到。
修复建议：先更换现有开发人员，因为这是小学生漏洞
公布一小部分拿到的数据：
{
"id": 1,
"userAccount": "superadmin",
"accountId": "superadmin",
"userRoleid": 10000,
"roleName": "超级管理员",
"userType": null,
"userStatus": 1,
"userEmail": "",
"userTelephone": "13439401009",
"departmentId": 11,
"departmentName": "总裁办"
},
{
"id": 207,
"userAccount": "闫励",
"accountId": "10001",
"userRoleid": 4,
"roleName": "董事长",
"userType": null,
"userStatus": 1,
"userEmail": "yantina@ice-biosci.com ",
"userTelephone": "13071105556",
"departmentId": 11,
"departmentName": "总裁办"
},
{
"id": 208,
"userAccount": "李英骥",
"accountId": "10002",
"userRoleid": 10,
"roleName": "总经理",
"userType": null,
"userStatus": 1,
"userEmail": "liy@ice-biosci.com ",
"userTelephone": "18611172849",
"departmentId": 11,
"departmentName": "总裁办"
},
{
"id": 209,
"userAccount": "邴铁军",
"accountId": "10082",
"userRoleid": 6,
"roleName": "副总经理",
"userType": null,
"userStatus": 1,
"userEmail": "bingtj@ice-biosci.com ",
"userTelephone": "15002200305",
"departmentId": 12,
"departmentName": "研发中心"
},
………………………………
"code": 200,
"message": "操作成功",
"data": [
{
"id": 187,
"sid": 601,
"level": "",
"supplyName": "北京百普赛斯生物科技股份有限公司",
"shortname": "",
"website": "",
"address": "北京市北京经济技术开发区宏达北路8号4幢4层",
"registerCapital": "",
"legalPerson": "",
"legalPhone": "",
"companyDes": null,
"bankName": "",
"bankAccount": "",
"logoPic": "http://47.105.110.112:9000/inno/logo3(2022-06-24 08:16:31).png",
"supplyStatus": 1,
"city": null,
"region": null,
"contactPerson": "李小林",
"contactPhone": "18555523133",
"contactEmail": "xiaolin.li@acrobiosystems.com",
"contactHomephone": "010-67855298",
"fax": null,
"wechat": null,
"qq": null,
"createTime": "2022-06-23T13:51:21",
"supplyLoginStatus": 1,
"supplierSource": null,
"taxRate": "3%",
"taxNumber": "911103025604366893",
"thirdCode": null
},
{
"id": 186,
"sid": 597,
"level": "",
"supplyName": "北京金诺思达生物技术有限责任公司",
"shortname": "",
"website": "",
"address": "北京市丰台区城南嘉园益城园16号楼11层2-1105",
"registerCapital": "500万元",
"legalPerson": "刘格华",
"legalPhone": "",
"companyDes": null,
"bankName": "",
"bankAccount": "",
"logoPic": "http://47.105.110.112:9000/inno/11111LOGO(2022-06-15 14:57:19).jpg",
"supplyStatus": 1,
"city": null,
"region": null,
"contactPerson": "马秋菊",
"contactPhone": "13124786011",
"contactEmail": "maqiuju@genostar.com.cn",
"contactHomephone": "010-87564931",
"fax": "010-87564931",
"wechat": null,
"qq": null,
"createTime": "2022-06-15T11:14:16",
"supplyLoginStatus": 1,
"supplierSource": null,
"taxRate": "13%",
"taxNumber": "91110106062841198M",
"thirdCode": null
},
{
"id": 185,
"sid": 547,
"level": "",
"supplyName": "北京同创诚诺生物科技有限公司",
"shortname": "",
"website": "",
"address": "北京市延庆区八达岭镇招商楼190号",
"registerCapital": "",
"legalPerson": "",
"legalPhone": "",
"companyDes": null,
"bankName": "",
"bankAccount": "",
"logoPic": "",
"supplyStatus": 1,
"city": null,
"region": null,
"contactPerson": "王金龙",
"contactPhone": "15011518062",
"contactEmail": "52742251@qq.com",
"contactHomephone": null,
"fax": null,
"wechat": null,
"qq": null,
"createTime": "2022-05-30T10:50:13",
"supplyLoginStatus": 1,
"supplierSource": null,
"taxRate": "13%",
"taxNumber": "91110119MA02A1GP2T",
"thirdCode": null
某日闲来无事，扫描到了一个科研系统，第一次尝试爆破，发现没有验证码，且密码大部分都是123456，相当于把企业信息全部泄露在外，曝光给了所有人。
于是将此信息报告给了涉事公司，公司反应还是比较迅速的。
不过效果吗，就感觉原来是完全裸露，现在加了一把锁，锁是很好看，但是钥匙就放在锁的旁边，要么就是这技术糊弄了公司，要么就是幼儿园水平。
入侵过程非常简单：打开首页地址如下：
然后根据加载的JS就可以拿到其所有的接口地址，根据其名字就能知道大概含义，产品，员工、订单、审核、供应商全都直接可以拿到。
修复建议：先更换现有开发人员，因为这是小学生漏洞
公布一小部分拿到的数据：
{
"id": 1,
"userAccount": "superadmin",
"accountId": "superadmin",
"userRoleid": 10000,
"roleName": "超级管理员",
"userType": null,
"userStatus": 1,
"userEmail": "",
"userTelephone": "13439401009",
"departmentId": 11,
"departmentName": "总裁办"
},
{
"id": 207,
"userAccount": "闫励",
"accountId": "10001",
"userRoleid": 4,
"roleName": "董事长",
"userType": null,
"userStatus": 1,
"userEmail": "yantina@ice-biosci.com ",
"userTelephone": "13071105556",
"departmentId": 11,
"departmentName": "总裁办"
},
{
"id": 208,
"userAccount": "李英骥",
"accountId": "10002",
"userRoleid": 10,
"roleName": "总经理",
"userType": null,
"userStatus": 1,
"userEmail": "liy@ice-biosci.com ",
"userTelephone": "18611172849",
"departmentId": 11,
"departmentName": "总裁办"
},
{
"id": 209,
"userAccount": "邴铁军",
"accountId": "10082",
"userRoleid": 6,
"roleName": "副总经理",
"userType": null,
"userStatus": 1,
"userEmail": "bingtj@ice-biosci.com ",
"userTelephone": "15002200305",
"departmentId": 12,
"departmentName": "研发中心"
},
………………………………
"code": 200,
"message": "操作成功",
"data": [
{
"id": 187,
"sid": 601,
"level": "",
"supplyName": "北京百普赛斯生物科技股份有限公司",
"shortname": "",
"website": "",
"address": "北京市北京经济技术开发区宏达北路8号4幢4层",
"registerCapital": "",
"legalPerson": "",
"legalPhone": "",
"companyDes": null,
"bankName": "",
"bankAccount": "",
"logoPic": "http://47.105.110.112:9000/inno/logo3(2022-06-24 08:16:31).png",
"supplyStatus": 1,
"city": null,
"region": null,
"contactPerson": "李小林",
"contactPhone": "18555523133",
"contactEmail": "xiaolin.li@acrobiosystems.com",
"contactHomephone": "010-67855298",
"fax": null,
"wechat": null,
"qq": null,
"createTime": "2022-06-23T13:51:21",
"supplyLoginStatus": 1,
"supplierSource": null,
"taxRate": "3%",
"taxNumber": "911103025604366893",
"thirdCode": null
},
{
"id": 186,
"sid": 597,
"level": "",
"supplyName": "北京金诺思达生物技术有限责任公司",
"shortname": "",
"website": "",
"address": "北京市丰台区城南嘉园益城园16号楼11层2-1105",
"registerCapital": "500万元",
"legalPerson": "刘格华",
"legalPhone": "",
"companyDes": null,
"bankName": "",
"bankAccount": "",
"logoPic": "http://47.105.110.112:9000/inno/11111LOGO(2022-06-15 14:57:19).jpg",
"supplyStatus": 1,
"city": null,
"region": null,
"contactPerson": "马秋菊",
"contactPhone": "13124786011",
"contactEmail": "maqiuju@genostar.com.cn",
"contactHomephone": "010-87564931",
"fax": "010-87564931",
"wechat": null,
"qq": null,
"createTime": "2022-06-15T11:14:16",
"supplyLoginStatus": 1,
"supplierSource": null,
"taxRate": "13%",
"taxNumber": "91110106062841198M",
"thirdCode": null
},
{
"id": 185,
"sid": 547,
"level": "",
"supplyName": "北京同创诚诺生物科技有限公司",
"shortname": "",
"website": "",
"address": "北京市延庆区八达岭镇招商楼190号",
"registerCapital": "",
"legalPerson": "",
"legalPhone": "",
"companyDes": null,
"bankName": "",
"bankAccount": "",
"logoPic": "",
"supplyStatus": 1,
"city": null,
"region": null,
"contactPerson": "王金龙",
"contactPhone": "15011518062",
"contactEmail": "52742251@qq.com",
"contactHomephone": null,
"fax": null,
"wechat": null,
"qq": null,
"createTime": "2022-05-30T10:50:13",
"supplyLoginStatus": 1,
"supplierSource": null,
"taxRate": "13%",
"taxNumber": "91110119MA02A1GP2T",
"thirdCode": null
Share Dialog
Share Dialog
No comments yet