Design defects and repair of Sina Weibo Certification

 

Brief description: Sina Weibo design defects, resulting in know the password of the original account, even if the password can be changed the same as the permissions to post microblogging, ADD Attention and other operations, can refer to the http://www.80sec.com/session-hijackin.html

Details: Sina Weibo certification has defects because user authentication is stored in

 

In the browser, when you change the password, the original authentication status will not expire, as long as the user remains unchanged, the user's identity will always be obtained.

Proof of vulnerability: open two browsers, one chrome and one ie. After logon, users in chrome and ie will not exit after the password is changed, resulting in a session hijacking attack, it seems that the password change is invalid.

Solution: http://www.bkjia.com/Article/200812/31068.html

 

Division of Authors