HexBrain

HackerOne · Report #105953

Parameter pollution in social sharing buttons

Validstatus
$500bounty
62upvotes
19 Dec 2015disclosed

How it was found

Hello! For example we have a link https://hackerone.com/blog/introducing-signal-and-impact, and we will change it to https://hackerone.com/blog/introducing-signal-and-impact?&u=https://vk.com/durov. If you send a link to the user and he wants to share a link to facebook, the content will change. https://www.facebook.com/sharer.php?u=https://hackerone.com/blog/introducing-signal-and-impact?&u=https://vk.com/durov

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original