Serious security vulnerabilities and risks are found in 21cn mailbox. You can change the password of any user on the mailbox requesting for password protection.

1. there is basically no appointment with the verification code for password retrieval in the mailbox. It is directly written in coke. It can be directly read from the cookie.

2. The password-protected email address is written on the page.Source code. View SourceCodeYou can see the answer and change the password from the page.

 

 

Process:

1. Choose to retrieve the secret protection through the Secret Protection Problem

Http://passport.21cn.com/getBackPwd_index.jsp? Types = 2

Note: The verification code is directly written in the cookie and is not encrypted.

 

2. Proceed to the next step

View the page source code:

 

3. Enter the result.

 

4. The password is successfully modified.

 

5. Log On with the new password.

 

6. view the result.

Note: The above public restrictions are for research. Please do not have any plans for destruction,

Ah, 21cn is not safe.