The user information leaked by unauthorized access exists on a site of Home Inn.

The user information leaked by unauthorized access exists on a site of Home Inn.

Rujia's website has unauthorized disclosure of user information that can be traversed #2

The problem still lies in home optimization.

Http://youxuan.homeinns.com/

After placing the order, return to the system again to view the information of the user who has been leaked due to the unauthorized operation like the order number.

Http://youxuan.homeinns.com/MyOrders/GetMyAllOrders
 

Packet capture data is as follows:
 

Modify the orderid Parameter
 

Http://youxuan.homeinns.com/MyOrders/GetOrderDetails