The buyer and seller can cancel any user order and execute it in batches.

I have mentioned this kind of questions many times, but it is still quite influential. register two accounts, place two orders, place orders for user a, place orders for user B, and then cancel orders for order 2, when an http request is intercepted and the post data is changed to the key Order Number of Order 1, the last five digits are used. You just need to change the data and find a rule again. You don't have time to traverse the numbers, use a tool similar to burp to parameterize the order number and run it directly. OK. The danger is that the result has been canceled. Submit the request and check the order status.
Solution:Malicious script execution is still very harmful. Permission control is very important. Determine whether the current user has the permission and pass another parameter.