TP-Link (flat technology) official online marketplace order canceled

In the official TP-Link online store, you can cancel orders of any other users.
Step 1: User A adds the order as follows:

Step 2: User B adds the order as follows:

Step 3: User A cancels his/her order. The request is as follows:
Https://www.tp-linkshop.com.cn/member/member_cancelOrder.htm? Oid = 26677
Intercept the request and change the value of the oid parameter to another value to cancel other orders,
In the same way, the oid value of user B's order can be 26680

If user A changes the oid to 26680, user B's order can be canceled.

The Location field value of the response returned by the server is as follows:

Step 4: Check the order status of user B. The order has been canceled successfully.