Kartpay · Report #1082288
Disclosure of Merchant_id into the source code without entered OTP code leads to Victims MID takeover.
Validstatus
criticalseverity
19upvotes
8 Mar 2021disclosed
Summary
The System Encryption for the merchant registration was revealing the details which can be further exploitable for the Registration of the merchant. After sharing the details by the @bugera it was fixed by the team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.