Auto home vulnerability series-modify or delete user information at will

Mall.autohome.com.cn allows you to modify or delete user information, such as personal receipt information. use two users to add one shipping information as follows (which can be distinguished by the browser); 2. obtains the shipping information id of one of the users. 3. use another user to modify the shipping information. The modified content is as follows: 4. click Save and capture, change the id value to "87337" of the first user, and submit. 5. return to the page for Refresh. The information with id 87337 is successfully modified. 6. we found that deleting the user's shipping information is directly a get request as follows; 7. we changed the above addid value to "87337" for submission, and successfully deleted the user's shipping information;
PS: Malicious attackers can directly use tools such as burpsuite and submit requests to delete the shipping information of all users !! Of course, you can also change the shipping information of all users !!

 Solution:

1. Filter sensitive characters; 2. strictly verify the validity of your identity;