Jiapin.com void any order

Jiapin.com void any order. After finding the order rule, use burp to run it in multiple threads. One account is voided and other orders are not used for a limited number of times.
Register and log on to the website. The website does not place an ordinary card to cancel the order. After the http request is intercepted, the userid and md5 are displayed, but they are not associated.

Modify the order number of the post data to another order number. The order on the current page is not voided. view the order status of the modified order.


The order for modifying the post is indeed voided.
Solution:

You can associate a parameter with userid. After all, not everyone can see others, or associate with the current cookies or session.