17 K novel network badges receive bugs for free and repair

 

Brief description:

If the 17K novel network badge does not meet the receiving conditions, it will receive one 100KB, but it will be available for free through unauthorized access.

Detailed description:

Http://www.17k.com/main/reader/huodong.do? Method = initHuodong

The K novel's anniversary event badge can be received free of charge if the conditions are met. If the conditions are not met, one will be collected kb.

 

OK. Proceed to the question:

Right-click the source code and find the doLingQu (para) function in the js Code.

We can see that the js Code obtained above is doLingQu (1), doLingQu (2)... doLingQu (5)

 

Direct access to/main/reader/huodong. do? Method = insertHuodong & flag = 0 & hdWords = 1/2/3.

Proof of vulnerability:

Javascript: doLingQu (1 );

Solution:

Add background code for verification

Www.2cto.com

 

Author: Lu renjia @ wooyun