Mobile phone number verification function Bypass Vulnerability (non-brute force attack, with technical analysis)

A function design defect of the resident Network (potential customers can be rejected )! The owner's user Registry has a design defect: http://union.zhuna.cn/reg.aspfill in the mobile phone number (of course, I don't have such a pretty mobile phone number). Click to get the verification code: enter a test verification code (verified: The verification code is four numbers ), error message: I accidentally clicked "get verification code" again. At this time, the proxy found a new one: is this the verification code sent to the mobile phone? Just try it! Complete other registration information and register successfully:

The verification code that should have been visible on the mobile phone. When the user obtains the verification code again, it is exposed naked! In this way, malicious users can register with any mobile phone number at will! If this is exploited by a competitor, if a potential customer wants to register, but finds that his or her number has been registered...