Delete any post on the phpcms V9 Q & A homepage

Http: // 118.244.225.145/index. php? M = ask & c = index & a = init & belong = index phpcmsV9 Q & a center is an application recently launched by phpcms, similar to the pattern that Baidu knows. If a parameter is not verified, any Post published by the user can be deleted! During the test, I deleted my post: http: // 118.244.225.145/index. php? M = ask & c = index & a = delete & dosubmit = 1 & aid % 5B % 5D = 217 we only need to know aid to delete any post.
The following post is used as an example: the publisher is test110, and my username is wutongyu, obviously not the same person. In this figure, askid = 192. We only need to construct: http: // 118.244.225.145/index. php? M = ask & c = index & a = delete & dosubmit = 1 & aid % 5B % 5D = 192. After the deleted post is accessed, it becomes like this:

Solution:Complete the product. Verify the user permissions and then delete them ..