Dangerous verification code-12306.cn errors

During the Spring Festival, there was a ticket flushing plug-in online, which provided us with much convenience for purchasing tickets. The verification code must be entered once. After the verification code is entered, you can use the software to submit the order automatically until the ticket is successfully booked, saving us from the trouble of trying again and again. All of these are verified by exploiting the website verification code vulnerability.

During the Spring Festival, there was a ticket flushing plug-in online, which provided us with much convenience for purchasing tickets. The verification code must be entered once. After the verification code is entered, you can use the software to submit the order automatically until the ticket is successfully booked, saving us from the trouble of trying again and again. All of these are verified by exploiting the website verification code vulnerability.

During the Spring Festival, there was a ticket flushing plug-in online, which provided us with much convenience for purchasing tickets.

The verification code must be entered once. After the verification code is entered, you can use the software to submit the order automatically until the ticket is successfully booked, saving us from the trouble of trying again and again. All of this uses the website verification code vulnerability. The verification code is not updated immediately after it passes verification, so you can continue to use the verification code next time.

Demo hello on:

---------------------------------------- Simulate 12306 -----------------------------------------------------------

 
 
-------------------------------------------------- Simulate ticket flushing ----------------------------------------------------------------------------
  "; Curl_close ($ ch); sleep (rand (1, 3 ));}}}
The running result is shown in the following figure:
If you enter the verification code only once, you will be able to brush the ticket unlimitedly !!!
    The solution is simple: after the Session verification is passed, kill $ _ SESSION ['vcode !!!

Download test code
Disclaimer: This article uses the CC BY-NC-SA 3.0 protocol for authorization
Reprinted, please indicate the source: Xiaojing's blog
Link: http://www.phpv5.com/blog/vcod