Allows you to change the password of another user by bypassing the function permissions of the cloud Communications Administration APP.

Allows you to change the password of another user by bypassing the function permissions of the cloud Communications Administration APP.

Attackers can change the password to reset others' accounts.

Change the phone number to another user's mobile phone number. Modify the pwd to log on with his account.
 

 

This is the test account. After logging on via the mobile app, click Change Password:
 

Modify parameters through burpsuite, change phone to the mobile phone number of the target account, and reset a pwd
 

You can log on to the target account with the new password:
 

You can also use this account to log on to the web site.
 

 

Solution:

Add verification and assign Permissions