Youmi Bao can reset any user password (all domain names registered here can be hijacked)

Youmi Bao can reset any user password (all domain names registered here can be hijacked)

RT

Domain Name merchant Security preemptible reset any user password (all domain names registered here can be hijacked)



Password retrieval address: http://www.jinmi8.com/u/getpwd1.html



I can see at a glance that there is a problem with his URL, and I can reset any user password.



Take website customer service as an Example



Step 1 enter the email address and verification code to retrieve the password


 

Step 2: Modify the url parameter to change 2 to 3.


 

Step 3: successfully bypass and start entering a new password
 

Step 4: Check If logon is successfully reset.


 

Fifth, there are many ID domains with a balance of 60 ID3.


 

 

You know your account can reset any user password. You're so careless. Who can come here to buy a domain name?
 

Solution:

Url and logic problems fixed