A site under Baidu has severe design defects

A site under Baidu has severe design defects

Img src = "/upload/201511/30143343 e5dfc2f4553a0fde8f89dc00f8a889b5.png" alt = "2.png"/>

Baidu bookstore domain name is ks.baidu.com


I first registered a bookstore number,


Then open http: // 111.13.108.103/index. php/login

Select to log on Via SMS and then send the SMS.

Four-digit SMS messages are found .. And there is no limit on the number of times.
 

<

 

<


I will run the 1000-10000 command again.

After being cracked for more than 4000 times, we can see that the attack was successful ..
 

 

Synchronous.

As shown above.

Solution:

6-digit verification code and a limited number of times ..