方维团购某系统任意删除漏洞

### 简要描述： 今天天气好热。 ### 详细说明： ``` 官方站：http://www.fanwe.com 官方演示站：http://t2.fanwe.net:86/ 漏洞问题：外卖配送地址可删除任意用户的地址信息 注册两个用户 用户A用户B ``` [<img src="https://images.seebug.org/upload/201506/0109554960c388d2692a3da1a4b98f2c4d6dd9df.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/0109554960c388d2692a3da1a4b98f2c4d6dd9df.jpg) [<img src="https://images.seebug.org/upload/201506/01095607464f475fd55aa8ef5f9c01d6481d3132.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/01095607464f475fd55aa8ef5f9c01d6481d3132.jpg) 对用户A进行删除抓包 [<img src="https://images.seebug.org/upload/201506/01095645e6a701ba18ed4b2b35aef853f80a2f3c.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/01095645e6a701ba18ed4b2b35aef853f80a2f3c.jpg) [<img src="https://images.seebug.org/upload/201506/010956511dd811b499c4de9fcffd348f63694f42.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/010956511dd811b499c4de9fcffd348f63694f42.jpg) 修改ID为用户B的36，成功删除 [<img src="https://images.seebug.org/upload/201506/0109572758caf2481bd628c71868a247f8b059e2.jpg" alt="5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/0109572758caf2481bd628c71868a247f8b059e2.jpg) [<img src="https://images.seebug.org/upload/201506/01095736c59ae372116168b7fb8679516cca502a.jpg" alt="6.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/01095736c59ae372116168b7fb8679516cca502a.jpg) 批量删除 [<img src="https://images.seebug.org/upload/201506/01095824138251169db96c0f865c0fd1cef7faaa.jpg" alt="7.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/01095824138251169db96c0f865c0fd1cef7faaa.jpg) [<img src="https://images.seebug.org/upload/201506/01095834a58b790401b51e469a1e810905c2c3d3.jpg" alt="8.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/01095834a58b790401b51e469a1e810905c2c3d3.jpg) [<img src="https://images.seebug.org/upload/201506/01095839a87768f1cc245a69a57c58c35f973808.jpg" alt="9.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/01095839a87768f1cc245a69a57c58c35f973808.jpg) ### 漏洞证明： RS