163 leakage of the online storage service mailbox can cause any User Password Reset Vulnerability

163 leakage of the online storage service mailbox can cause any User Password Reset Vulnerability

RT: I forced the vendor to write a mistake yesterday. Face it.

Due to some negligence, all emails sent to the 163 Network Disk are disclosed, which can reset any user password in disguise.

Let's take a look
 

 

 

 

 

 

Then we can prove that the password of any user is reset.
 

 

User name mhsk123 password 123456

 

Username qq736552586 password 123456

Some people say this may be a common weak password. As the saying goes, you can do it too.

Mom told me how to install the full set
 

 

Where is the leak?
 

Then

Leak address:

m.163disk.com/data/cache_smtp.php.bak

 

Solution:

Delete the backup configuration file.