Information of users/employees on the free network under the chain home is completely leaked

One interface has no permission control and can obtain all information of any employee or tenant. All information includes email, mobile phone number, ID card number, home address, marital status, job (employee), company, security questions, and security questions .. exist in password retrieval page: http://www.ziroom.com /? _ P = sign & _ a = weakpassowrd & step = 1 & type = forgetpassword interface: The http://www.ziroom.com/index.php? _ P = api & _ a = customer & type = search & login_name = 158 xxxxxxxx you can use the mobile phone number to traverse all the data and do not control the return value without frequency (the result is a public employee mobile phone number): Open the above url directly.Solution:Here, you only need to know whether the mobile phone number exists and do not need to return all information. We recommend that you perform online status verification or permission control on this interface.