A parallel permission vulnerability in street network can traverse user details

A parallel permission vulnerability in street network can traverse user details

Information includes: name, gender, mobile phone (if the user has entered), location, school, Major, admission time, and other mobile phones connected to the computer wifi, proxy set, system with burp. click to open a personal center to capture:

The above timestamp removes three zeros at the end, that is, the admission time major: 73 refers to the computer class (other types can be seen on the street network). livicity: 510100 Chengdu base64 encoding, solution:

Check the uid and modify the base64 encoding before submitting the Code:

Writing a script to traverse is not difficult ~


Vulnerability repair solution:
Restrictions