HexBrain

Kartpay · Report #1082891

Duplicate Entry of email leads to 500 Server Error which disclosing the SQL Database table information

Validstatus
criticalseverity
39upvotes
14 Mar 2021disclosed

Summary

The Issue was with the process of Deletion of the merchant data from the admin Dashboard. The Admin has rights to delete the merchant email ID and further, it gets deleted as Soft delete, not the full delete but there was no Validation to the codes which can detect the re-registration of the same Email ID which leads to the Critical error.

Secondly, it was found that while pushing the codes in the production, The Debug was enabled and show the data only needed for internal use.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original