Veris · Report #120291
Critical IDOR - Set anyone's Terminal Data remotely
Validstatus
3upvotes
12 Jun 2016disclosed
How it was found
Hello Team,
I have found a critical IDOR using which an attacker can SET anyone's terminal data remotely by just changing a terminal/gatekeeper id in PUT Request.
Proof of Concept: Please find it attached.
Best Regards,
Hely H. Shah