金蝶某云服务网站任意用户密码重置漏洞

### 简要描述： 生活遇到问题,参考人生简单粗暴的四大法则:“不行就分,喜欢就买,多喝点水,重启试试。” ### 详细说明： http://cs.kdweibo.com/space/c/user/forget-password 金蝶云网站，点击忘记密码，然后可以输入手机号码，输入138 8888 8888 居然存在，然后可以看出是4位验证码 [<img src="https://images.seebug.org/upload/201506/0916244435218c2922b11cff5cfb9a9f6a301d05.jpg" alt="jindie2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/0916244435218c2922b11cff5cfb9a9f6a301d05.jpg) 然后就是暴力破解，根据返回长度查看验证码 [<img src="https://images.seebug.org/upload/201506/09162525cbb193858818a049b3356c7cb3061360.jpg" alt="jindie.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09162525cbb193858818a049b3356c7cb3061360.jpg) 然后重置成功，就可以用账户登录网站了www.kdweibo.com [<img src="https://images.seebug.org/upload/201506/09162625cf74b55e68b46679ba20687f4d0716e1.jpg" alt="jindie3(1).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09162625cf74b55e68b46679ba20687f4d0716e1.jpg) 各种信息，浏览一下 [<img src="https://images.seebug.org/upload/201506/091627117a32495e2ac39352d9a124fc2e145d37.jpg" alt="jindie3(2).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/091627117a32495e2ac39352d9a124fc2e145d37.jpg) 企业沟通 http://im.kdweibo.com/xtweb/web/login.jsp [<img src="https://images.seebug.org/upload/201506/09162735bc3835b67c3f99fc808acb3027a26730.jpg" alt="jindie3(3).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09162735bc3835b67c3f99fc808acb3027a26730.jpg) ### 漏洞证明： 重置管理员密码： [<img src="https://images.seebug.org/upload/201506/09162749605912b5895abd196c30351ce330a43d.jpg" alt="jindie3(4).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09162749605912b5895abd196c30351ce330a43d.jpg) [<img src="https://images.seebug.org/upload/201506/09162801eb917b1a4f3d64dab3977ed717f5cd1b.jpg" alt="jindie4(0).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09162801eb917b1a4f3d64dab3977ed717f5cd1b.jpg) 金蝶云之家管理，列表系统都可以进去 http://manage.kdweibo.com/manage/integration/list-org.action [<img src="https://images.seebug.org/upload/201506/09162811641de147109924b38404d5be374123b7.jpg" alt="jindie4(1).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09162811641de147109924b38404d5be374123b7.jpg) 通讯录还有泄漏手机号码的员工，可以去进行重置。 [<img src="https://images.seebug.org/upload/201506/09162820638d5da8aa434655dcdcea2f960700a8.jpg" alt="jindie4(2).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09162820638d5da8aa434655dcdcea2f960700a8.jpg) 对数据可以进行操作 [<img src="https://images.seebug.org/upload/201506/09163757bff58724df424fff5dcbfedc5ab2eea4.jpg" alt="4(3).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09163757bff58724df424fff5dcbfedc5ab2eea4.jpg) [<img src="https://images.seebug.org/upload/201506/091638279218399e992ddc6744924b19ee53afc7.jpg" alt="4(4).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/091638279218399e992ddc6744924b19ee53afc7.jpg) 金蝶企业云管理 http://do.kdweibo.com/mcloud/pages/cust/cust_info.jsp [<img src="https://images.seebug.org/upload/201506/09162917ddca128087bf943663669f180b2626db.jpg" alt="jindie4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09162917ddca128087bf943663669f180b2626db.jpg) 可以对申请使用产品和管理正使用的产品 [<img src="https://images.seebug.org/upload/201506/09162831607d4358bd12373020231064d67f13e5.jpg" alt="jindie4(n-1).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09162831607d4358bd12373020231064d67f13e5.jpg) [<img src="https://images.seebug.org/upload/201506/09162842eedb8e3c6d4563ed61105ef7c99bf4ea.jpg" alt="jindie4(n).jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/09162842eedb8e3c6d4563ed61105ef7c99bf4ea.jpg)