1 + 1 large online games in China are severely unauthorized, and all of their financial and user privacy services are in a hurry.

1 + 1 large online games in China are severely unauthorized, and all of their financial and user privacy services are in a hurry.

1 + 1 large online games in China are severely unauthorized, and all of their financial and user privacy services are in a hurry.

Allows you to reset the password, information, ID card, and other information of any player and log on to the game. This seriously affects the game order and allows you to steal accounts, involving financial and privacy services. It is China's No. 1 online game platform.



Over 150 gamers



Serious emergency. Please handle it !!

#1 excessive permissions, million user privacy leaks





URL:


 

http://www.dajiawan.com/admin.php?module=HuiYuan&action=Detail&uid=

Uid can be traversed, 1-1500000,150 W user uid



Direct unauthorized access to user Members for various viewing and operations



For example:


 

http://www.dajiawan.com/admin.php?module=HuiYuan&action=Detail&uid=33086

This user has spent more than RMB, and all mobile phones, QQ, ID card, name, email, and IP addresses are leaked.






 

 

#2 second excessive authorization, 1 + 1 reset any User Password



Under the first excessive view, the second excessive permission can modify the user's mailbox without administrator cookie Verification


 

Of course, you can also visit the following URL to traverse all the UIDs and directly modify and save the mailbox


 

http://www.dajiawan.com/admin.php?module=HuiYuan&action=ChangeEmail&uid=

Both methods are supported.



After modification, you can see that a user mailbox is successfully modified to 123@qq.com


 

Then select "forgot password" at the home page logon"



Enter the new email address to retrieve the password, and enter the user name and email address. The user name can be viewed in the first excessive authority. The email address is your own email address in the second excessive authority, then, you can reset the password of any user by email.


 

 

 

Successfully logged on to the user, with a balance of more than RMB


 

The above test is not malicious. the user's original email address has been changed after the test!