瓦城 LINE服務驗證機制缺失 - HITCON ZeroDay

Vulnerability Detail Report

Vulnerability Overview

  • ZDID: ZD-2025-00247
  •  發信 Vendor: 瓦城泰統股份有限公司
  • Title: 瓦城 LINE服務驗證機制缺失
  • Introduction: 可以無限制取得優惠券，可以傳給任何人使用

處理狀態

目前狀態

公開
Last Update : 2025/05/22
  • 新提交
  • 已審核
  • 已通報
  • 未回報修補狀況
  • 未複測
  • 公開

處理歷程

  • 2025/03/22 12:02:39 : 新提交 (由 Cactus 更新此狀態)
  • 2025/03/23 00:57:52 : 新提交 (由 Cactus 更新此狀態)
  • 2025/03/23 01:08:28 : 新提交 (由 Cactus 更新此狀態)
  • 2025/03/24 14:36:45 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2025/03/25 15:55:11 : 修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2025/03/25 15:55:12 : 修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2025/05/22 03:00:06 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

  • ZDID：ZD-2025-00247
  • 通報者：BBrain (Cactus)
  • 風險：中
  • 類型：邏輯漏洞 (Logic Flaws)

參考資料

攻擊者可經由該漏洞繞過網站邏輯行為進行惡意攻擊。

漏洞說明： OWASP - Testing for business logic
https://www.owasp.org/index.php/Testing_for_business_logic

漏洞說明： CWE-840: Business Logic Errors
https://cwe.mitre.org/data/definitions/840.html
(本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)

相關網址

https://game-module.no8.io/game/coupon?access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb3Vwb24iOnsiY291cG9uU2V0SWQiOiJ2MnlHcXZtVFlpRG82SjZHSjhWTCIsImNvdXBvblR5cGUiOiJwcml6ZSIsImNvdXBvbk5hbWUiOiLjgJDlpKflv4PjgJHms7DlnIvlpbbojLYiLCJpbWdVcmwiOiJodHRwczovL2Fzc2V0cy5ubzguaW8vY291cG9uLW1vZHVsZS9VUXdKbXllSUZzLzE3MDAxMDQ5NDQwNTZfMTUlRTUlQTQlQTclRTUlQkYlODMlRTYlQjMlQjAlRTUlOUMlOEIlRTUlQTUlQjYlRTglOEMlQjYlRTclQjQlQTAlRTYlOUQlOTAlRTQlQkElOEMucG5nIiwiY291cG9uRGVzYyI6IsK3IOaMgeaKteeUqOWIuOiHs-WFqOWPsOWkp-W_g--8jOavj-ahjOa2iOiyu-a7vyQzNTDlhYPvvIzljbPlj6_mirXnlKjkuZnlvLXvvIzlubPml6XjgIHlgYfml6Uo5ZCr5ZyL5a6a5YGH5pelKeeahumBqeeUqO-8jOWWruethue1kOW4s-a2iOiyu-avj-ahjOmZkOeUqOS4gOasoeOAglxuwrcg6ZmQ5LiL5qyh55So6aSQ5L2_55So77yM5pWI5pyf6Iez6aCY5Yi4MzDml6XlhafmnInmlYjvvIzpgL7mnJ_nhKHmlYjjgIJcbsK3IOacrOWIuOmcgOaWvOm7numkkOeVtuS4i-S4u-WLleWHuuekuu-8jOe1kOWujOW4s-W-jOWHuuekuuimluWQjOajhOasiu-8jOe_u-aLjeeEoeaViOOAglxuwrcg6ZmQ5YWn55So6aSQ6aOy5oq155So77yM5oGV54Sh5rOV6LO86LK36Zu25ZSu5ZWG5ZOBL-aKmOePvi_mi4bmoYwv5ouG5ZauL-WkluW4ti_lpJbpgIEv57ea5LiK6bue6aSQ77yM5oiW6IiH5YW25LuW5YSq5oOg5rS75YuV5L2155So44CCXG7CtyDoi6Xlm6DmtojosrvogIXmiYvmqZ_ntrLot6_pgKPnt5rllY_poYzmiJblhbbku5blgIvkurrlm6DntKDvvIzlsI7oh7TnhKHms5XlhYznjY7vvIzmnKzlhazlj7jmgZXkuI3osqDosqzjgIJcbsK3IOacrOWIuOeCuui0iOWTgeS_guWxrOeEoeWEn-WPluW-l--8jOS4jemWi-eri-e1seS4gOeZvOelqC_mib7pm7Yv5oqY54--77yM5LiN6YGp55So77yI5pyN5YuZ77yJ56au5Yi46KiY6LyJ5LmL6KaP56-E44CCXG7CtyDnk6bln47pm4blnJjkv53mnInmnIDntYLmtLvli5XmsbrlrprmrIoiLCJleHBpcmVkQXQiOiIyMDI1LTA0LTIxVDAzOjM5OjA3LjQ5M1oiLCJhd2FyZHNCdG4iOiLnq4vljbPlhYzmj5siLCJjb3Vwb25Db2RlIjoiOGRsa3c2WEs2diIsImNvdXBvbklkIjoiN0ZQSzk4dGIzUHdyZDBIN0VlN2giLCJ1c2VkIjpmYWxzZX0sImxpbmVMaWZmSWQiOiIyMDAxMjg5NjUyLTV4MkQ3ZDk2IiwibGluZUNoYW5uZWxJZCI6IjIwMDEyODk2NTIiLCJsaW5lQWNjb3VudElkIjoiQDc4OWFqaXVyIiwib3JnYW5pemF0aW9uSWQiOiJVUXdKbXllSUZzIiwiZm9yd2FyZFBhZ2UiOiJjb3Vwb24iLCJjdXN0b21lcklkIjoiVTE3Y2U0Y2I4ZTVkMjMzNzQ3ZmRiNmU0YzkxZTkwZmExIiwiaWF0IjoxNzQyNjE1NTI1LCJleHAiOjE3NDI2MTczMjV9._ekrQ8vAFgJLIRBtcEhI7sghnvgvmctTHkgUVvI9yGQ

------------------------------------------------------------
https://game-module.no8.io/game/coupon?access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb3Vwb24iOnsiY291cG9uU2V0SWQiOiJ2MnlHcXZtVFlpRG82SjZHSjhWTCIsImNvdXBvblR5cGUiOiJwcml6ZSIsImNvdXBvbk5hbWUiOiLjgJDlpKflv4PjgJHms7DlnIvlpbbojLYiLCJpbWdVcmwiOiJodHRwczovL2Fzc2V0cy5ubzguaW8vY291cG9uLW1vZHVsZS9VUXdKbXllSUZzLzE3MDAxMDQ5NDQwNTZfMTUlRTUlQTQlQTclRTUlQkYlODMlRTYlQjMlQjAlRTUlOUMlOEIlRTUlQTUlQjYlRTglOEMlQjYlRTclQjQlQTAlRTYlOUQlOTAlRTQlQkElOEMucG5nIiwiY291cG9uRGVzYyI6IsK3IOaMgeaKteeUqOWIuOiHs-WFqOWPsOWkp-W_g--8jOavj-ahjOa2iOiyu-a7vyQzNTDlhYPvvIzljbPlj6_mirXnlKjkuZnlvLXvvIzlubPml6XjgIHlgYfml6Uo5ZCr5ZyL5a6a5YGH5pelKeeahumBqeeUqO-8jOWWruethue1kOW4s-a2iOiyu-avj-ahjOmZkOeUqOS4gOasoeOAglxuwrcg6ZmQ5LiL5qyh55So6aSQ5L2_55So77yM5pWI5pyf6Iez6aCY5Yi4MzDml6XlhafmnInmlYjvvIzpgL7mnJ_nhKHmlYjjgIJcbsK3IOacrOWIuOmcgOaWvOm7numkkOeVtuS4i-S4u-WLleWHuuekuu-8jOe1kOWujOW4s-W-jOWHuuekuuimluWQjOajhOasiu-8jOe_u-aLjeeEoeaViOOAglxuwrcg6ZmQ5YWn55So6aSQ6aOy5oq155So77yM5oGV54Sh5rOV6LO86LK36Zu25ZSu5ZWG5ZOBL-aKmOePvi_mi4bmoYwv5ouG5ZauL-WkluW4ti_lpJbpgIEv57ea5LiK6bue6aSQ77yM5oiW6IiH5YW25LuW5YSq5oOg5rS75YuV5L2155So44CCXG7CtyDoi6Xlm6DmtojosrvogIXmiYvmqZ_ntrLot6_pgKPnt5rllY_poYzmiJblhbbku5blgIvkurrlm6DntKDvvIzlsI7oh7TnhKHms5XlhYznjY7vvIzmnKzlhazlj7jmgZXkuI3osqDosqzjgIJcbsK3IOacrOWIuOeCuui0iOWTgeS_guWxrOeEoeWEn-WPluW-l--8jOS4jemWi-eri-e1seS4gOeZvOelqC_mib7pm7Yv5oqY54--77yM5LiN6YGp55So77yI5pyN5YuZ77yJ56au5Yi46KiY6LyJ5LmL6KaP56-E44CCXG7CtyDnk6bln47pm4blnJjkv53mnInmnIDntYLmtLvli5XmsbrlrprmrIoiLCJleHBpcmVkQXQiOiIyMDI1LTA0LTIxVDE2OjU5OjQ5LjQ0OFoiLCJhd2FyZHNCdG4iOiLnq4vljbPlhYzmj5siLCJjb3Vwb25Db2RlIjoiRjZVeFN4YXBGMiIsImNvdXBvbklkIjoiZ2tsclBZeDVzZlVwdkI2b0FaU1YiLCJ1c2VkIjpmYWxzZX0sImxpbmVMaWZmSWQiOiIyMDAxMjg5NjUyLTV4MkQ3ZDk2IiwibGluZUNoYW5uZWxJZCI6IjIwMDEyODk2NTIiLCJsaW5lQWNjb3VudElkIjoiQDc4OWFqaXVyIiwib3JnYW5pemF0aW9uSWQiOiJVUXdKbXllSUZzIiwiZm9yd2FyZFBhZ2UiOiJjb3Vwb24iLCJjdXN0b21lcklkIjoiVTE3Y2U0Y2I4ZTVkMjMzNzQ3ZmRiNmU0YzkxZTkwZmExIiwiaWF0IjoxNzQyNjYzMjYzLCJleHAiOjE3NDI2NjUwNjN9.QBbX7K_pXFiqyjVeg-dQU5qKnonajTbZKM4mZu0dbik

敘述

只要填寫過一次問卷就可以獲得一杯泰式奶茶的兌換券按鈕，日後只要在官方LINE上點擊"點我即刻領取"就可以無限制取得到泰式奶茶兌換券。可以繞過"點我領取大心泰式奶茶"的每次領取一次限制。

其實在填寫問卷的地方有做身分驗證的步驟，即使把問券連結傳給其他人填寫，優惠券是發送者領取。但是如果直接點擊"點我即刻領取"後收到的優惠券可以傳給任何人

如果點擊"點我即刻領取"出現失敗通知，只要先點擊"點我領取大心泰國奶茶"再重新點擊"點我即刻領取"即可獲得

擷圖

留言討論

聯絡組織

 發送私人訊息
您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
;