search

caokang / waimai

超级外卖 Super Cms是专业的外卖订餐系统，使用它，不用写代码，只要会打字，就可以管理网站。 前台设计采用采用html5与css3设计，兼容IE6+、Firefox、Chrome、Safari、Opera等主流浏览器. 并可以在微博，微信中完美显示。后台功能模块化设计，用户操作方便。 易于上手，即安即用。 适合餐馆，酒店，外卖平台，糕点店，海鲜店【此地址用于维护】,详细问题，见链接
MIT License
142 stars 83 forks source link

This is a payment logic vulnerability that can modify the value of payment #15

Open Binarytree200 opened 4 years ago

Binarytree200 commented 4 years ago

First of all, we choose to use points to exchange products. for example you want to exchange this product, you need to use 5 points image

image

Then we can get the request package. image

We changed the value of the parameter credit to -1. image

image

We've managed to get this product for free. image