If the order for the mobile phone version is leaked, the unauthorized permission can be canceled.

Source: Internet
Author: User

If the order for the mobile phone version is leaked, the unauthorized permission can be canceled.

Order Information is leaked without directly disclosing user information

Cancelling others' orders

Order ID can be traversed, full-site access ......

Low vulnerability impact

We found that the mobile edition and the computer edition use the same database

You can cancel the whole site

I'm sorry for the canceled orders ......



Register first, and then log on to the mobile phone version rent-out.


 





Select two good cars, just a little better.


 





Certification materials


 





Order takes effect, view your order information


 





Take a closer look at the Order ID


 





My order number is 1434. You can change the value to 1425 and view the order of another person.


 





Someone else's information is displayed.



Check the order status: To be confirmed.



Now let's make a comparison ......


 





The link to cancel: http://m.zuyaya.com/update_order_status.action? OrderId = 1435



Change the ID to 1425



Http://m.zuyaya.com/update_order_status.action? OrderId = 1425



And then access it in the address bar.



It's really beyond the authority ......


 







@ Tiexiao huochexia: There is no 15 Rank for two taxi networks to traverse beyond the authority?



Low vulnerability impact



We found that the mobile edition and the computer edition use the same database



You can cancel the whole site


Solution:

Add permission Control

Order ID hiding or encryption

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.