当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：
wooyun-2014-077724
漏洞标题：
比亚迪某分站源码泄漏
相关厂商：
bydauto.com.cn
漏洞作者：
Summer
提交时间：
2014-09-29 11:26
修复时间：
2014-11-13 11:28
公开时间：
2014-11-13 11:28
漏洞类型：
敏感信息泄露
危害等级：
低
自评Rank：
5
漏洞状态：
厂商已经确认
漏洞来源：
http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签：
无
分享漏洞：
4人收藏 收藏
分享漏洞：
>

漏洞详情

披露状态：

2014-09-29： 细节已通知厂商并且等待厂商处理中
2014-09-30： 厂商已经确认，细节仅向厂商公开
2014-10-10： 细节向核心白帽子及相关领域专家公开
2014-10-20： 细节向普通白帽子公开
2014-10-30： 细节向实习白帽子公开
2014-11-13： 细节向公众公开

简要描述：

详细说明：

http://121.15.172.116/bbs.zip

11a.jpg


漏洞证明：

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
	<!--   文件上传    -->
	<servlet>
		<servlet-name>UploadFileServlet</servlet-name>
		<servlet-class>
			com.byd.erpit.tools.util.UploadFileServlet
		</servlet-class>
	</servlet>
	<servlet-mapping>
		<servlet-name>UploadFileServlet</servlet-name>
		<url-pattern>/UploadFileServlet</url-pattern>
	</servlet-mapping>
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>
			/WEB-INF/classes/applicationContext.xml
		</param-value>
	</context-param>
	<listener>
		<listener-class>
			org.springframework.web.context.ContextLoaderListener
		</listener-class>
	</listener>
	<listener>
		<listener-class>
			com.byd.erpit.base.listener.AnonymSessionListener
		</listener-class>
	</listener>
	<listener>
		<listener-class>
			com.byd.erpit.base.listener.AppServletContextListener
		</listener-class>
	</listener>
	<filter>
		<filter-name>setCharacterEncoding</filter-name>
		<filter-class>
			org.springframework.web.filter.CharacterEncodingFilter
		</filter-class>
		<init-param>
			<param-name>encoding</param-name>
			<param-value>UTF-8</param-value>
		</init-param>
	</filter>
	<!--  hibernate session filter  -->
	<filter>
		<filter-name>hibernateFilter</filter-name>
		<filter-class>
			org.springframework.orm.hibernate3.support.OpenSessionInViewFilter
		</filter-class>
		<init-param>
			<param-name>sessionFactoryBeanName</param-name>
			<!--指定对Spring配置中哪个sessionFactory使用OpenSessionInView-->
			<param-value>projSessionFactory</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>hibernateFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	<filter-mapping>
		<filter-name>setCharacterEncoding</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	<servlet>
		<servlet-name>dispatcher</servlet-name>
		<servlet-class>
			org.springframework.web.servlet.DispatcherServlet
		</servlet-class>
		<init-param>
			<param-name>contextConfigLocation</param-name>
			<param-value>
				/WEB-INF/classes/dispatcher-servlet.xml
			</param-value>
		</init-param>
		<load-on-startup>2</load-on-startup>
	</servlet>
	<servlet-mapping>
		<servlet-name>dispatcher</servlet-name>
		<url-pattern>*.ajax</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>dispatcher</servlet-name>
		<url-pattern>*.htm</url-pattern>
	</servlet-mapping>
	<display-name>FCKeditor.Java Sample Web Application</display-name>
	<description>FCKeditor.Java Sample Web Application</description>
	<servlet>
		<servlet-name>ConnectorServlet</servlet-name>
		<servlet-class>
			net.fckeditor.connector.ConnectorServlet
		</servlet-class>
		<load-on-startup>1</load-on-startup>
	</servlet>
	<servlet-mapping>
		<servlet-name>ConnectorServlet</servlet-name>
		<!-- Do not wrap this line otherwise Glassfish will fail to load this file -->
		<url-pattern>
			/fckeditor/editor/filemanager/connectors/*
		</url-pattern>
	</servlet-mapping>
	<servlet>
		<description>
			This is the description of my J2EE component
		</description>
		<display-name>
			This is the display name of my J2EE component
		</display-name>
		<servlet-name>DownloadFile</servlet-name>
		<servlet-class>
			com.byd.erpit.servlet.DownloadFile
		</servlet-class>
	</servlet>
	<servlet-mapping>
		<servlet-name>DownloadFile</servlet-name>
		<url-pattern>/servlet/DownloadFile</url-pattern>
	</servlet-mapping>
	<session-config>
		<session-timeout>30</session-timeout>
	</session-config>
	<welcome-file-list>
		<welcome-file>redirect.jsp</welcome-file>
	</welcome-file-list>
	<jsp-config>
		<taglib>
			<taglib-uri>/WEB-INF/erpit-tag.tld</taglib-uri>
			<taglib-location>/WEB-INF/erpit-tag.tld</taglib-location>
		</taglib>
		<taglib>
			<taglib-uri>/WEB-INF/erpit-functions.tld</taglib-uri>
			<taglib-location>
				/WEB-INF/erpit-functions.tld
			</taglib-location>
		</taglib>
	</jsp-config>
</web-app>

修复方案：

版权声明：转载请注明来源 Summer@乌云

>

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：1

确认时间：2014-09-30 11:34

厂商回复：

此zip压缩包中的源码是一个开源软件源码，不是网站本身的源代码。非常感谢作者的测试。

最新状态：

暂无