U.S. Dept Of Defense · Report #1004750
IDOR + Account Takeover [UNAUTHENTICATED]
Validstatus
criticalseverity
17upvotes
9 Nov 2020disclosed
How it was found
1- Open the burp suite. 2- Switch the "Repeater" tab. 3- Paste the content of the attached request into the repeater. 4- Replace the "UID2 = 4820041" value in the cookie with the ID value of the user to be attacked. Also write the user's email in the "userName" input. 5- Replace the victim user's password
Note: Follow the steps in the "1004745" report to get the user's email address.
Impact
You can change users' passwords and take over their account.