Arbitrary password reset vulnerability in wheat bags (2)

Previously, the password reset vulnerability of any user in the wheat bag was discovered. As a result, I changed my mind and found that I could reset the password of any user in the wheat bag in another way, which is more serious than the previous one. How can I change the password in seconds !~~ Detailed Description: Cause of the vulnerability: no strict verification is performed on the password reset link. Reset Password link composition: http://login.mbaobao.com/reset_password.html? Username = username & code = a string of md5-type encrypted characters. You can reset any user password by modifying the username. Password Reset process: 1 old rule, click forgot password 2 select mailbox retrieve password 3 mailbox received a retrieval password Link 4 click that link, the Password Reset page is displayed. 5. Change the email account in the address bar to another account (registered by mobile phone number). You can also go to the password change page. 6. The password is successfully modified. 7. Try to log on. If you successfully log on to 8, you just reset your account. It seems that the power is not enough. Now, let's modify others. Here I tried to use the user name "mbaobao", which means there is no pressure and I will change it in seconds! (Please use the database to change the password)






The verification process is as follows. I personally guess the cause of this vulnerability is that there is a problem with the verification of the password reset address, which should be verified as follows: Determine whether the code and username both exist in the server database. If yes, then the verification is passed. It does not determine whether the code and username correspond one by one, or the code and username are not designed to correspond one by one. This code does not have a time validity period. During the test, the code of the link I used was obtained four days ago. And this code has no limit on the number of times, and it seems that it will never expire... Compared to the previous password reset vulnerability,Arbitrary password reset vulnerability in wheat bags, This is a more serious amount. You only need to know the user name, you can change the password in seconds...Patch:1. Set the code and username to one-to-one correspondence. 2. Set the code's timeliness and set a code to expire only once.