07073 modify the password of any user on the game Network

You only need to enter an EMAIL address to retrieve the password.
First, we should find a target in the forum. Well, it's him, ID1, and modern people who are outdated.
 
We entered the outdated modern people in the pass retrieval password field and entered the verification code.
Then there is a chicken hole in the vulnerability, and the user's EMAIL address is directly sent through the GET method. Well, we will know his EMAIL address.
 
17 ***** @ qq.com
 
 
 
 
Next, we need a controllable EMAIL (nonsense) to retrieve the password of our account and get a password reset address.
 
We can enter a modified password, and then confirm to cut the package!
Change your EMAIL address to the EMAIL address of ID1 above!
 
 
 
 
Okay, it's successful.
 
 
 
 
=
And then the first-to-Second Channel ~ Enter the pass ~~
 
 
 
 
Then the Forum
 
 
 
 
The password on the background of the Forum is changed to the password above... 600 million + users.
 
 

 
Ps. It seems that the Forum has not been patched for a long time ......

.
Solution:

The user's email address is not directly sent when the password is retrieved through the mailbox.
 
Add a TOKEN to the Password Reset page to bind it to the EMAIL address of the password reset, to prevent modifying the EMAIL address and changing the password of others
 
Patch the forum .........