World Factory Network design defects critical User Account Security

World Factory Network design defects critical User Account Security

This Password Reset Vulnerability contains four SMS verification codes and has no limit on the number of attempts. This vulnerability can be exploited to crack the vulnerability.

Vulnerability address:
Http:// I .gongchang.cn/mod/user/GetPassword/

1. If you see a mobile phone number in the Forum, use the mobile phone number as an example.
 

2. Enter the mobile phone number, send the verification code, and submit a brute-force cracking attack to the Verification code. The correct verification code is 7997.
 

 

3. Get the correct verification code and replace the returned error verification code with the response package of the correct verification code. You can proceed to the next step.
 

4. Enter New Password Reset and submit.
 

5. The password is successfully reset.
 

 

Use the new password we reset to log on.
 

 

Solution:

1. Set the verification code to 6 Characters

2. Set the maximum number of password attempts, for example, 5