Kartpay · Report #1082891
Duplicate Entry of email leads to 500 Server Error which disclosing the SQL Database table information
Validstatus
criticalseverity
39upvotes
14 Mar 2021disclosed
Summary
The Issue was with the process of Deletion of the merchant data from the admin Dashboard. The Admin has rights to delete the merchant email ID and further, it gets deleted as Soft delete, not the full delete but there was no Validation to the codes which can detect the re-registration of the same Email ID which leads to the Critical error.
Secondly, it was found that while pushing the codes in the production, The Debug was enabled and show the data only needed for internal use.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.