KesionIMalv2.5逻辑漏洞（DEMO演示）

### 简要描述： RT ### 详细说明： demo地址：http://imall.kesion.com 修改购物车内商品数量时，抓包修改为-1，提交订单后，点击支付，该订单直接支付成功。 [<img src="https://images.seebug.org/upload/201507/09180846114030338fc393b4d7060a7dfae7f775.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201507/09180846114030338fc393b4d7060a7dfae7f775.jpg) [<img src="https://images.seebug.org/upload/201507/09180856fa8afd356a7c6f8c89f3a28ddcc558d7.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201507/09180856fa8afd356a7c6f8c89f3a28ddcc558d7.jpg) [<img src="https://images.seebug.org/upload/201507/09180904d62be085cff4f76b7ffdf41ff9dca3e9.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201507/09180904d62be085cff4f76b7ffdf41ff9dca3e9.jpg) [<img src="https://images.seebug.org/upload/201507/09180944667a4b98799d8d049b67b17735285d96.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201507/09180944667a4b98799d8d049b67b17735285d96.jpg) [<img src="https://images.seebug.org/upload/201507/091809494fec48aaeef6f362ec7e5be34600d0cb.jpg" alt="5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201507/091809494fec48aaeef6f362ec7e5be34600d0cb.jpg) [<img src="https://images.seebug.org/upload/201507/091809566213a48254a7533bcb1956496aa88b1b.jpg" alt="6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201507/091809566213a48254a7533bcb1956496aa88b1b.jpg) [<img src="https://images.seebug.org/upload/201507/0918110270fae07a625d786dbb9cd2bcbd774407.jpg" alt="7.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201507/0918110270fae07a625d786dbb9cd2bcbd774407.jpg) ### 漏洞证明： 如上