115 vote for free vote and repair on the Internet drive doll

Brief description: design defects, lax restrictions, unrestricted voting by sending packets!

I personally think that voting in this way is generally used as a reference, or purely democratic.
Detailed description:
POST/ajax/post_vote? Aid = 145 HTTP/1.1

X-requested-with: XMLHttpRequest

Accept-Language: zh-cn

Referer: http://katong.115.com/lists

Accept :*/*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; QQDownload 679; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1 ); embedded Web Browser from: http://bsalsa.com /;. net clr 2.0.50727 ;. NET4.0C ;. NET4.0E)

Host: katong.115.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie :*****

The vote is actually UA. If you change the UA, you can vote again.
So as long as the price after UA function immediately, you can brush the ticket without restrictions.
Proof of vulnerability:

 

Solution: Add IP address restrictions, or log on to the 115 account to vote. You have more methods than me.