ThinkSNS modify username and password of any account (including administrator)

The user account information can be directly modified (including the Administrator) because no judgment has been made for a change)
Change email activation-> modify the email address of any uid-> log in-> use the changed email address to retrieve the password

Because
Index. php? App = public & mod = Register & act = changeActivationEmail & uid = 10
The inactive user email address can be modified and the user account can be hijacked by modifying the user email address or checking the password.

No judgment made

Previously Registered account

Simulate POST

Modified successfully

Login and password retrieval

 

 

Administrator or something. I have no problem locally. I should have never tried it online.
Solution:
Probably:



 

Supports thinkSNS! The more you do, the better.