The password retrieval function of Dingding allows you to log on to another user's account as predicted.

If you know the login name or email address of another user, you can log on to another user's account.

The password retrieval logic has serious security issues. The link to the password retrieval is as follows:
 
Http://www.docin.com/app/updateUserValidate? Type = pwd & email = hello@gmail.com & id = 641483319f5dbb10dc20e4c2aac6eab9 & num = 1340620118434
 
 
Note: In the password retrieval connection, num is actually a timestamp when the password is retrieved. email is the login email address, and id is an md5 id, therefore, the entire Link is actually predictable, so we can use this ID to log on to other people's douding, And the email can be obtained through cross-site access.
 
Proof of vulnerability:
This does not prove to me.

The author Tang Zui