The unauthorized access of a kubernetes website may expose sensitive user information such as names and phone numbers.

The unauthorized access of a kubernetes website may expose sensitive user information such as names and phone numbers.

To be honest, this place is really amazing.

1. register an account and log on:
 

2. Select any product and go to the order confirmation page:
 

 

 

3. The unauthorized access point appears. Click "Add new address:
 

4. Fill in the information and click "OK 』:
 

5. Click Edit again, click confirm, and capture packets:
 

6. Remove all values between "id" and "& _ form_token" and change the id to any value:
 

7. Click forward:
 

The user's name, phone number, and address appear.



You can retrieve all the user information!

 

 

Solution:

Control user permissions, not just adding a token.