Arbitrary Password Reset caused by design defects of a substation in sogou

Arbitrary Password Reset caused by design defects of a substation in sogou

Non-violent, second reset.

The problem is that sogou cloud testing launched a business a few months ago.

Mt.sogou.com
 

Session coverage

Use your mobile phone number to register two accounts A B

Open the homepage and forget the password. Enter the mobile phone number A and click send verification code.
 

Open another page in the same browser and enter the number B. You do not need to send the verification code.
 

Then, enter the Verification Code received by mobile phone A and reset the number B.

You can reset the password of any account without disturbing yourself.

Solution:

Session determines the user.