An interface for password verification in Meituan can be cracked (affecting Meituan merchants and Meituan take-out merchants)

An interface for password verification in Meituan can be cracked (affecting Meituan merchants and Meituan take-out merchants)

An interface for password verification in Meituan can be cracked (hundreds of merchant accounts can be successfully logged in), affecting Meituan merchants and Meituan take-out merchants.

The password change function is available at the background of the Meituan take-out seller.

Http://e.waimai.meituan.com/
 

The first data packet is used to verify that the original password is correct.
 

I selected three letters for dictionary brute force collision.

The result of password collision with 123456 is as follows (256)
 

Because Meituan merchant account is universal, you can log on to the http://e.meituan.com/
 

Another takeout
 

 

Above

(If you need to test your account, please trust me)

Solution:

Restrict sensitive interfaces