Horizontal permission of a pharmaceutical house network APP

Horizontal permission of a pharmaceutical house network APP

When saving the address modification screen, you can change the userid to the ID of another user and then save the address to another user.

In addition, CSRF exists in this screen. You can save the addresses in batches to other accounts, although it makes no sense.

But as a security issue, please correct it.



Address modification screen:



Userid: 188
 

 

Userid: 156
 

 

User 156 changes the userid to the value of user 188 when modifying the address.
 

Before Modification
 

After modification
 

Successful
 

The user's mobile phone number of 188 is confirmed, and the address is crossed...
 

 

Solution:

Verify the userid and add the token for instantaneous authorization verification.