The moji.com app is unauthorized to add the user's shipping address.

The moji.com app is unauthorized to add the user's shipping address.

Preparation:

Create two accounts A and B

Access moji mall through moji weather mobile client

1. Add the shipping address

There is a userid in the request data for adding the shipping address. You can modify it to add the shipping address to the specified userid.
 

Create the shipping address in account A, capture the package when submitting the request, and change it to the userid of Account B.
 

View Account B's address and add the content

Attackers can traverse the userid to add malicious addresses to the whole site.

Solution:

Permission Control