11. modify any password on the website platform

This vulnerability is in account management and is a logical issue. The 11 account of jianxin is punking. Obtain the punking id from the recording center as 301098178 Logon account management. Click Change Password and capture packets. Change the id_id parameter value in the second request package to 301098178 and the return package to change the password. Enter the password to be modified. Click OK to modify the punking password.

 Solution:

Verify the identity of the primary account and subaccount.