Qunar.com user authentication mechanism problems and repair solutions

Brief description:

There are problems with the use and handling of user authentication information stored on the client. Other problems such as xss can easily cause the authentication system to crash. In particular, it involves orders and other money transactions.
Detailed description:

The core of the qunar.com authentication system is based on the three cookies of qvt. Although these three cookies will change, the server only uses an algorithm to verify the correctness of the data, without verifying the cookie's timeliness, an attacker can use this cookie to replace the victim for any operation, for example, if an attacker obtains cookies from other users through xss. The victim's password, account, and other information are not required. In addition, as long as the authentication system is not changed, this cookie is permanently valid, even if the victim changes the password. Finding an xss is too easy,
Proof of vulnerability:

Burp, just put your logout cookie in and try it.
Solution:

Change the password. Do not attack the user name and password!
Author: unic02n @ wooyun