Tongda Information Disclosure Scanner

The Tongda software is widely used in corporate environments, primarily for managing office automation tasks. It is designed to facilitate employee management, communication, and project tracking in companies of various sizes. HR departments, project managers, and administrative personnel commonly utilize this system to streamline operations and ensure efficient document handling. Its deployment can be found across sectors such as finance, manufacturing, and technology, where it supports daily business activities. Furthermore, it is employed to enhance the productivity of staff by providing them with the tools necessary to collaborate effectively. Additionally, Tongda is often integrated with other enterprise systems to provide a comprehensive management solution.

The information disclosure vulnerability in Tongda exposes sensitive session details of users. Attackers could exploit this flaw to gather unauthorized information about user sessions, potentially leading to privacy breaches. Insecure handling of session data could present attackers with opportunities to impersonate legitimate users. This vulnerability arises due to insufficient access controls to adequately protect session information from malicious entities. Identifying and rectifying such vulnerabilities is crucial to maintaining the confidentiality and integrity of user data. Proper measures must be taken to prevent unauthorized access to sensitive information.

Technical details indicate that the vulnerability resides in the 'userinfo.php' endpoint. This endpoint inadequately protects user session data, making it susceptible to unauthorized access. The disclosure problem surfaces when session-related information like 'dept_name' and 'online_flag' is exposed in the response body. Furthermore, requests returning the status code 200 reveal that JSON-encoded session data is communicated improperly. Such issues often stem from the failure to implement robust session management policies, leaving systems open to potential exploitation. Addressing these shortcomings is necessary to secure user sessions from illicit access and manipulation.

If exploited, this vulnerability could allow attackers to hijack user sessions, leading to unauthorized access to confidential information. Users could face privacy invasions, and corporate data, including sensitive documents, might be accessed or mishandled by unauthorized personnel. The compromise of session data may result in regulatory non-compliance and damage to the organization’s reputation. Clients and stakeholders could lose trust in the company’s ability to safeguard their data. Overall, exploiting this vulnerability could have severe repercussions on the organization’s operations and public image.

REFERENCES

• https://mp.weixin.qq.com/s/llyGEBRo0t-C7xOLMDYfFQ