Password bypass in a game warehouse in Kingsoft (directly modify key data)

Password bypass in a game warehouse in Kingsoft (directly modify key data)

When resetting the warehouse password, you can directly modify the information without confirmation.

Send 49 00 F9 46 00 01 41 00 43 32 53 5F 73 74 73 77 64 00 03 00 00 00 21 00 00 32 30 32 43 42 39 36 32 43 35 30 37 35 42 39 36 42 30 37 31 35 32 44 32 33 34 42 37 30 30 00 04 00 00 33 32 31 00 01 00 00 00 00 00



To the server, you can set the answer to the repository password to 123, and then use the answer to this question to directly change the repository password.

The cause of this vulnerability is that the correct password is verified before modification, but the correct password is not re-verified during modification.

 

 

Solution:

Reset the modification method