### 简要描述： 某网上商城系统任意订单取消 ### 详细说明： 1、先提交一个订单之后点击取消抓包 [<img src="https://images.seebug.org/upload/201504/15134707da1a3871bbc091c7ab8f9625dffe3b76.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15134707da1a3871bbc091c7ab8f9625dffe3b76.png) 2、打开抓到的url 提示ok [<img src="https://images.seebug.org/upload/201504/1513472964b0332245f2a554643361630bdb9172.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/1513472964b0332245f2a554643361630bdb9172.png) [<img src="https://images.seebug.org/upload/201504/151347344d7cf9bbcb6e57259548e5dc3bd446c0.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/151347344d7cf9bbcb6e57259548e5dc3bd446c0.png) 3、来看看我们的订单是不是取消了 [<img src="https://images.seebug.org/upload/201504/1513474995ba63b9a78d3bfbc7dbc72137a52427.png" alt="4.png" width="600"...
### 简要描述： 某网上商城系统任意订单取消 ### 详细说明： 1、先提交一个订单之后点击取消抓包 [<img src="https://images.seebug.org/upload/201504/15134707da1a3871bbc091c7ab8f9625dffe3b76.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15134707da1a3871bbc091c7ab8f9625dffe3b76.png) 2、打开抓到的url 提示ok [<img src="https://images.seebug.org/upload/201504/1513472964b0332245f2a554643361630bdb9172.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/1513472964b0332245f2a554643361630bdb9172.png) [<img src="https://images.seebug.org/upload/201504/151347344d7cf9bbcb6e57259548e5dc3bd446c0.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/151347344d7cf9bbcb6e57259548e5dc3bd446c0.png) 3、来看看我们的订单是不是取消了 [<img src="https://images.seebug.org/upload/201504/1513474995ba63b9a78d3bfbc7dbc72137a52427.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/1513474995ba63b9a78d3bfbc7dbc72137a52427.png) 成功取消了 4、下面我换一个号来提交3个订单订单号分别是258 259 260 前面的200多个订单都可以取消测试嘛就自己来 [<img src="https://images.seebug.org/upload/201504/151349375ce8c99e7b9fac75aa1c3b5546863226.jpg" alt="5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/151349375ce8c99e7b9fac75aa1c3b5546863226.jpg) [<img src="https://images.seebug.org/upload/201504/1513494371e28e5e44b60cc2fdc49c059d575ec4.png" alt="6.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/1513494371e28e5e44b60cc2fdc49c059d575ec4.png) [<img src="https://images.seebug.org/upload/201504/15134951fde1dc37a96bc27a3413eaef81dc4d42.jpg" alt="7.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15134951fde1dc37a96bc27a3413eaef81dc4d42.jpg) [<img src="https://images.seebug.org/upload/201504/15135005869c3d17a5303a9cedb76ca15babf53c.jpg" alt="8.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15135005869c3d17a5303a9cedb76ca15babf53c.jpg) ok 5、下面我们来打开url试试测试取消 [<img src="https://images.seebug.org/upload/201504/15135114fc4f29ced219bcf0ca0f57a45895ffea.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15135114fc4f29ced219bcf0ca0f57a45895ffea.png) [<img src="https://images.seebug.org/upload/201504/151351182745b8d20d7580102aec1dffe6a14b0b.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/151351182745b8d20d7580102aec1dffe6a14b0b.png) [<img src="https://images.seebug.org/upload/201504/1513512481c56efaf16c04c86a96a1db2fb98f48.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/1513512481c56efaf16c04c86a96a1db2fb98f48.png) 都提示ok 我们来我的订单处查看是否取消 [<img src="https://images.seebug.org/upload/201504/15135141ef0e7daf358ea5165b9790abd42503ec.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15135141ef0e7daf358ea5165b9790abd42503ec.jpg) 都成功取消了 ### 漏洞证明： 1、先提交一个订单之后点击取消抓包 [<img src="https://images.seebug.org/upload/201504/15134707da1a3871bbc091c7ab8f9625dffe3b76.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15134707da1a3871bbc091c7ab8f9625dffe3b76.png) 2、打开抓到的url 提示ok [<img src="https://images.seebug.org/upload/201504/1513472964b0332245f2a554643361630bdb9172.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/1513472964b0332245f2a554643361630bdb9172.png) [<img src="https://images.seebug.org/upload/201504/151347344d7cf9bbcb6e57259548e5dc3bd446c0.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/151347344d7cf9bbcb6e57259548e5dc3bd446c0.png) 3、来看看我们的订单是不是取消了 [<img src="https://images.seebug.org/upload/201504/1513474995ba63b9a78d3bfbc7dbc72137a52427.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/1513474995ba63b9a78d3bfbc7dbc72137a52427.png) 成功取消了 4、下面我换一个号来提交3个订单订单号分别是258 259 260 前面的200多个订单都可以取消测试嘛就自己来 [<img src="https://images.seebug.org/upload/201504/151349375ce8c99e7b9fac75aa1c3b5546863226.jpg" alt="5.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/151349375ce8c99e7b9fac75aa1c3b5546863226.jpg) [<img src="https://images.seebug.org/upload/201504/1513494371e28e5e44b60cc2fdc49c059d575ec4.png" alt="6.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/1513494371e28e5e44b60cc2fdc49c059d575ec4.png) [<img src="https://images.seebug.org/upload/201504/15134951fde1dc37a96bc27a3413eaef81dc4d42.jpg" alt="7.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15134951fde1dc37a96bc27a3413eaef81dc4d42.jpg) [<img src="https://images.seebug.org/upload/201504/15135005869c3d17a5303a9cedb76ca15babf53c.jpg" alt="8.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15135005869c3d17a5303a9cedb76ca15babf53c.jpg) ok 5、下面我们来打开url试试测试取消 [<img src="https://images.seebug.org/upload/201504/15135114fc4f29ced219bcf0ca0f57a45895ffea.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15135114fc4f29ced219bcf0ca0f57a45895ffea.png) [<img src="https://images.seebug.org/upload/201504/151351182745b8d20d7580102aec1dffe6a14b0b.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/151351182745b8d20d7580102aec1dffe6a14b0b.png) [<img src="https://images.seebug.org/upload/201504/1513512481c56efaf16c04c86a96a1db2fb98f48.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/1513512481c56efaf16c04c86a96a1db2fb98f48.png) 都提示ok 我们来我的订单处查看是否取消 [<img src="https://images.seebug.org/upload/201504/15135141ef0e7daf358ea5165b9790abd42503ec.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201504/15135141ef0e7daf358ea5165b9790abd42503ec.jpg) 都成功取消了
