Shenzhen Airlines can view powder information without authorization (name, ID card, contact number, and other sensitive information)

Shenzhen Airlines can view powder information without authorization (name, ID card, contact number, and other sensitive information)

Shenzhen Airlines can view powder information without authorization (name, ID card, contact number, and other sensitive information)

The permission escalation vulnerability exists when you use the Shenzhen Airlines client to view powder information. You can view other user information.

(1) Request data information when you click the powder information. Key data information: USER_ID
 

(2) The server returns power information. Including name, ID card number, gender, contact number, and other sensitive information.
 

(3) only modify USER_ID for replay and return other user information.