AA carpool vulnerability 3 # (full-site user passwords can be modified in batches if AA carpool is improperly designed)

AA carpool vulnerability 3 # (full-site user passwords can be modified in batches if AA carpool is improperly designed)

We changed our password and captured the package. We found the following interface:

 

The following serviceKey is a decoration that takes effect for any user.



Go to the official website and find an active user to replace the number for testing.
 

Comparison of return values
 

 

Login test successful


 

 

 

Get a mobile phone number library and use burp to traverse the user information of the whole site !!! I promise not to be with you! Haha!