Order prices can be modified at will

Order prices can be modified at will

Ordinary merchants on the internet can browse others' orders at will, modify others' order information at will, and discount specified orders.

1. First, you have to be a merchant of the zookeeper network. If not, you can obtain a merchant account free of charge for large-scale leakage of passwords in the background of WooYun: zookeeper network. (You can directly use the pengkk004@126.com, password pass.123 login)

2. Once logged on, any order can be accessed in a format like http://shop.kouclo.com/trade/order_detail/2015011920000013327. Whether it's yours or not. The Order Number is composed of year, month, day, and serial number. Try changing the order number to 2015011920000013328. If you change it to 2015011920000013330, you will find a bunch of errors. What should I do? Just tune the previous date to 2015012020000013330.



3. Note that there is a price change form. You don't have to worry about it. It can be used!

1. Any order browsing
 

 

2. Any order discount Modification
 

 

3. view other orders at will
 

 

 

Solution:

Enhance permission check! Remember that all user input is untrusted, and all GET access POST accesses are untrusted.