KFC 4008823823.com Mobile Phone Number Ordering verification can be bypassed, causing leakage of real user information and other problems

Source: Internet
Author: User

Phone verification codes for phone ordering can be bypassed, causing leakage of real user information and other problems. It cannot be too detailed here ,,
Well, don't raise the price later. It's too expensive ,,
Detailed description:
On the order page, select "order by phone", enter the mobile phone number, and click "Send verification code". The normal process is that the mobile phone number receives the Verification Code. However, burp captures the packet and finds that the verification code is returned to the client. Therefore, the verification code is essentially a false one. Enter the verification code to view the order address of the mobile phone number.



 
Proof of vulnerability:
 
 
 
There are two consequences:
1. Leakage of real customer information
2. If mc is in trouble with you, place an order for the customer .... The loss is real gold and silver, so rank is higher.
Solution:
That,
1. The Verification Code cannot be sent to the client,
2. Shorten the validity period,
3. Restrict submission interval to prevent brute-force cracking.
So detailed, cool is really a white hat!

Author: unic02n

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.