Bypass OTP verification when placing Order

How it was found

User can bypass the OTP verification needed while placing an order with a restaurant. User can give a random number and intercept the OTP request. If wrong OTP is provided then the error message shows the session code which is the OTP in this case. Hence that session code can be used to verify the phone number and the order can be placed. Similarly,by intercepting the final order placing request,one can change the number and place N number of orders with restaurant.

Please Refer to the attached POC.