Ys Modify the user-bound mobile phone number function There is a logical bypass vulnerability, do not need the old mobile phone number to bind the new mobile phone number "high"

YSModify the user-bound mobile phone number function There is a logical bypass vulnerability, do not need the old mobile phone number to bind the new mobile phone number "high"

Problem Description:

          This issue can be used as an extension of the above-mentioned horizontal vulnerability issue, assuming that the horizontal vulnerability has been patched, the user login random session ID is a unique identity as a user, at this time, although the user can not modify the other person's mobile phone binding number, but may modify their own binding mobile phone number, that does not need the old phone number can also be re-binding new phone number.

Test steps:

1. Openburpintercept agents, and enablehttprequest interception function.

2. Suppose the mobile phone number currently bound by the test account is as shown:

3. The User Registration screen uses an unregistered account to send a verification code to an unbound mobile phone number, which can be arbitrarily specified by the user .

4. Useburpblock requests to modify the binding numberhttpRequest and Enter the above unbound mobile phone number and the corresponding verification code in the request, assuming thatSession IDA field is a unique identity that identifies a user, andAs_useridfield does not work,

5. Click Send this request, the server response is displayed successfully,

6. To refresh the test account information, you can see that the account binding number has changed,

problem Extension:

          If the attacker is in some way (such as xss attack" obtained the user's cookie

Solution Recommendations:

1,   in verifying the old phone process do not pass the mobile phone number, directly through the database query, to prevent illegal tampering.

2,   http request is submitted to the server.

Ys Modify user-bound mobile phone number function There is a logical bypass vulnerability, do not need the old mobile phone number to bind the new mobile phone number "high"