Auspicious aviation logic vulnerability allows you to reset any User Password

Auspicious aviation logic vulnerability allows you to reset any User Password

Incorrect Design for password retrieval at the auspicious airlines Main Site

Step 2 send the verification code to capture packets

Because there is no limit on the number of times the verification code is entered, it can be cracked and results can be generated within 10 seconds.

Enter the correct verification code to go to the password reset step and set the password to 11112222

Successful

Log in to view user information, etc.


The danger of resetting the password of the main site is still quite high.

Solution:

Change verification code verification rules 1. Limited number of times 2. Increase the number of digits