ThinkSNS V3 defect-01

Fan scalping vulnerability! Supports CSRF and Home Page worms. Test only!

Currently, official V3 users are 3 K + users. For more information, see here.

Site:
Http://demo.thinksns.com is still a demo, it is necessary to test.

The CSRF worm can be caused by a direct GET method without adding or removing any concern for the CSRF.

Check two requests:

Follow someone:
GET/t3/index. php? App = public & mod = Follow & act = doFollow & fid = 39XX HTTP/1.1

Cancel follow:
GET/t3/index. php? App = public & mod = Follow & act = unFollow & fid = 39XX HTTP/1.1

Of course, this fid is the object to be taken care! Fl

You can use this method to insert this link anywhere on the ThinkSNS site. Of course, the most direct thing is to put it on the homepage!

Anyone can view the dynamic information on the homepage and click it to automatically follow this fid.

Of course, for better results, you can make the content more attractive!

When other users click this dynamic button

Followed successfully.

Failed to follow because this is my own and I cannot follow myself.

Soon, I will receive notifications from new fans.

 

Whether you are writing logs or updating the status, you can talk about this dynamic synchronization to the home page and send a Weibo post so that everyone can follow you!

Test only, not crawling

Solution:

Anti-csRF, various token.