Arbitrary user order traversal of changtu Network (a large amount of sensitive information)

The problem lies in the changtu app. After logging on to the mobile phone, the mobile phone finds that there is almost no verification for the query request. The only parameter "pkTicketOrderId and userId" does not check each other. The following is the query data packet;

POST http://ios.update.trip8080.com/iphone/v0600/orderQuery.htm HTTP/1.1 Host: ios. update. trip8080.comConnection: closeAccept-Encoding: gzipContent-Type: application/x-www-form-urlencoded; charset = utf-8Content-Length: 37 Connection: closeUser-Agent: changtu bus ticket 2.3.4 (iPhone; iPhone OS 7.0.4; zh_CN) pkTicketOrderId = 496849 & userId = 1707376

 

Here, the userId parameter must be included in the request, but the specific value does not affect the result. By modifying the pkTicketOrderId parameter, all users' orders can be traversed. In the order, "name, ID number, mobile phone number, "password acquisition" and other information are at a glance;


Solution:Add various verifications