Alimama travel network payment vulnerability 2

This payment vulnerability is from point store ......
1. The number of items exchanged by the credit mall is not checked ......
2. At the same time, it does not prevent tampering.
3. Only the points of the current point and the item are checked to determine whether the points can be redeemed.
 
 
 
 
 
 
 
 
Offer debugging tools:
 
 
 
The modified data mainly modifies the user points so that the user points can continue to be exchanged after the product points are greater than the product points. At the same time, the number of products is changed to a negative number ......
 
 
 
Redeem successfully, points are extended ~~~~
 
 
 
 
The manufacturer may say that it will check the order and will not deliver the goods. However, after I test it, this point can be used for lottery and coupon redemption. It can be used anyway ......




 
Solution:
 
 
1. Check whether the number of items is negative.
2. Tamper-proofing
3. It is recommended that all of these operations be performed on the server ~~ Do not place it on the client