HexBrain

Veris · Report #120291

Critical IDOR - Set anyone's Terminal Data remotely

Validstatus
3upvotes
12 Jun 2016disclosed

How it was found

Hello Team,

I have found a critical IDOR using which an attacker can SET anyone's terminal data remotely by just changing a terminal/gatekeeper id in PUT Request.

Proof of Concept: Please find it attached.

Best Regards,

Hely H. Shah

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original