Other user password vulnerabilities in the host room

Other user password vulnerabilities in the host room

Modify others' passwords

First, we need to register an account on the host and bind the mailbox

Then, go to the homepage and find the forgot password feature.
 

Enter the registered account here



Click Next


 

Then, receive the verification code in the email address and enter it here.



Go to burpsuite now


 

Here is the account I registered. I changed it to the target account annann (this is the administrator account in another vulnerability in the host house on WOOYUN)


 

The system prompts that the authentication is successful.


 

But not yet



Enter the new password and continue with the burpsuite.


 

Here, we still change our account to annann.


 

Password modified


 

Solution:

Dongzhu, senior high school dog, ran the internet cafe at noon and begged not to ignore this vulnerability.