Multiple Fixed High‑Risk EDUSRC and Corporate SRC Vulnerabilities Revealed

0x1 Introduction

The author shares a set of previously discovered EDUSRC and corporate SRC vulnerabilities that have already been fixed, and also mentions a few recent crowdsourced testing cases that are interesting but not yet disclosed because the bugs remain unpatched.

0x2 Interesting Crowdsourced Testing Cases

Two high‑risk bugs from a recent crowdsourced test are presented. Both stem from a common pattern the author often uses when testing WeChat mini‑programs: extracting the sessionkey and analyzing network packets. The target apps belong to service‑industry businesses (hotels, travel, etc.), which typically expose many functional endpoints.

The first case exploits the "one‑click login" feature that uses a phone number. By capturing the login request, the attacker can obtain three session‑key related fields, modify them to a different phone number, and replay the packet to achieve unauthorized login.

During re‑play the login initially fails, likely because the backend added a validation after a previous report. The author then inspects the response packet and discovers two plaintext parameters:

{"phoneNumber":"xxxxxxxxx",
"purePhoneNumber":"xxxxxxxxxx"}

By replacing these values with a phone number the author controls (e.g., 166‑xxxx‑xxxx) and sending the modified packet, login succeeds.

0x3 EDUSRC Case Sharing

1. Unauthorized API

A previously found API endpoint in an educational system allowed enumeration of student records by iterating student IDs. The endpoint URL is:

xxxxxx/xxxxx/Student/RecommendationForm.aspx?Xsxh=学号

Accessing this URL with sequential student numbers returned sensitive scholarship information, classifying it as a high‑severity EDU vulnerability.

2. SQL Injection

The second EDU case is a classic SQL injection discovered in a search box. Supplying the payload 1' caused a server error that leaked the absolute file path, indicating a POST‑type injection point.

The author captured the request with Burp Suite, saved it to a text file, and fed it to sqlmap. The tool enumerated database names, table names, and eventually extracted the admin credentials, allowing full backend access.

0x4 Conclusion

The article wraps up by noting that while the number of cases is limited, the detailed vulnerability steps are valuable for security practitioners. It contrasts corporate SRC and crowdsourced testing with EDU SRC, highlighting that EDU bugs often involve higher‑impact data leakage. The author encourages readers to keep studying such cases to improve their own vulnerability discovery skills.