Alibao API exposes sensitive information of all investors (mobile phone number and investment amount)

Alibao API exposes sensitive information of all investors (mobile phone number and investment amount)

Financial Product Investment records leak investors' mobile phone numbers

GET the investment record url for the web app: GET/api/p2ps/2682/records/

Host: www.wanglibao.com

Because you do not need to log on, You can directly access it in a browser. You can get the mobile phone number and investment quota of investors in the corresponding financial products, and the mobile phone number information of the local tyrants is exposed.

Like https://www.wanglibao.com/api/p2ps/2836/records/
 

 

Solution:

The server processes the data before returning it.