中国电信 EMA 服务管理平台二期扩容安全验收漏洞修复总结
目 录
1 WEB 安全介绍.........................................................................................................................1
2 SQL 注入、盲注 ......................................................................................................................1
2.1 SQL 注入、盲注概述.................................................................................................................1
2.2 安全风险及原因 ...................................................................................................................2
2.3 APPSCAN 扫描建议 ......................................................................................................................2
2.4 应用程序解决方案 ...............................................................................................................4
3 会话标识未更新......................................................................................................................7
3.1 会话标识未更新概述 ...........................................................................................................7
3.2 安全风险及原因分析 ...........................................................................................................7
3.3 APPSCAN 扫描建议 ......................................................................................................................8
3.4 应用程序解决方案 ...............................................................................................................8
4 已解密登录请求......................................................................................................................8
4.1 已解密登录请求概述 ...........................................................................................................8
4.2 安全风险及原因分析 ...........................................................................................................8
4.3 APPSCAN 扫描建议 ......................................................................................................................9
4.4 应用程序解决方案 ...............................................................................................................9
5 跨站点请求伪造....................................................................................................................11
5.1 跨站点请求伪造概述 .........................................................................................................11
5.2 安全风险及原因分析 .........................................................................................................12
5.3 APPSCAN 扫描建议 ....................................................................................................................12
5.4 应用程序解决方案 .............................................................................................................12
6 不充分账户封锁....................................................................................................................13
6.1 不充分账户封锁概述 .........................................................................................................13
6.2 安全风险及原因分析 .........................................................................................................13
6.3 APPSCAN 扫描建议 ....................................................................................................................13
6.4 应用程序解决方案 .............................................................................................................13
7 启用不安全 HTTP 方法 ..........................................................................................................14
7.1 启用不安全 HTTP 方法概述 ...............................................................................................14
7.2 安全风险及原因分析 .........................................................................................................14
7.3 APPSCAN 扫描建议 ....................................................................................................................15
7.4 应用程序解决方案 .............................................................................................................15
8 HTTP 注释敏感信息...............................................................................................................16
8.1 HTTP 注释敏感信息概述.........................................................................................................16
8.2 安全风险及原因分析 .........................................................................................................16
8.3 APPSCAN 扫描建议 ....................................................................................................................16
8.4 应用程序解决方案 .............................................................................................................16
9 发现电子邮件地址模式.........................................................................................................16
