Gratipay · Report #126010
prevent content spoofing on /~username/emails/verify.html
Duplicatestatus
2upvotes
10 Jul 2017disclosed
How it was found
Steps to Verify:
- Login to your Gratipay account.
- Now navigate to the following url
https://gratipay.com/~your_username/emails/verify.html?email=your%20account%20has%20expired.%20You%20must%20renew%20it%20to%20use%20your%20account.%20To%20continue%20you%20have%20to%20send%20your%20login%20credentials%20to%[email protected].%20A%20Gratipay%20executive%20will%20contact%20you%20after%20that.%20Sorry%20for%20this%20intereption,%20we%20know%20this&nonce=x
POC screenshot attached.
Regards Uttam