HackerOne · Report #105953
Parameter pollution in social sharing buttons
Validstatus
$500bounty
62upvotes
19 Dec 2015disclosed
How it was found
Hello! For example we have a link https://hackerone.com/blog/introducing-signal-and-impact, and we will change it to https://hackerone.com/blog/introducing-signal-and-impact?&u=https://vk.com/durov. If you send a link to the user and he wants to share a link to facebook, the content will change.
https://www.facebook.com/sharer.php?u=https://hackerone.com/blog/introducing-signal-and-impact?&u=https://vk.com/durov