Bug of logging on to any account in the Online Shopping System (except for background management)

Many asp shopping sites have been replaced by the webshell kernel, but this vulnerability exists in none of the above cases, including the latest and earlier versions of webshells. However, the damage is still relatively high. You can log on to and modify the password of any user.

Vulnerability file: saveuserinfo. asp

Code Analysis:

 

Get the username value directly from the cookie without any filtering.

 

Exp:

After login, you can directly change the cookie's username value to any user name. Because you can change the username value, and you do not need to enter the original password when changing the password, as a result, you can directly change the cookie's username value and then click Change Password to change the current username value.

I should be able to mine SQL Injection in depth based on this bug. I am too lazy and handed it to all kinds of Daniel ~ It's best to send me a copy. Haha ~