IDOR Causing Deletion of any account

Summary

The researcher demonstrated how to close other users account, using a IDOR in community.ubnt.com he was able to delete all data in others account using the user id number of the victim.

IDOR in Community.ubnt.com :500$

Created two user:-- Attacker with username:--vibhuti123_i Victim:-- John_victim

Vulnerability—Critical -IDOR causing Deletion of community account.For this close account option should be enable in community platform. This is a critical IDOR causing any user’s community account deleted by any other user.The simple step is in Video POC Link. Victim can rejoin again but he will not get back his posts,messages,badges,kudo points,Friends,achievement,Reply,images,followers,following and manything.He may rejoin with same username but he will never get anything (posts,messages,badges,kudo points,Friends,Reply,images,achievements,followers,following and manything) back again. Let understand with below example:-- suppose victim has username john_victim with 9posts,12 reply,2 messages,10 friends,8 badges ,2 posts,10 image in album.If attacker deleted his account then Everything is deleted all posts,badges,friends,reply,images .But again victim can rejoin but he will not get previously achieved or created posts,reply,badges,followers,friends,image and all.He has to start from scratch.

POC:--Video https://youtu.be/nLAtXUhw65k

Important point:-- In video after deletion of victim account due to presence of browser cache(mistakenly told cache server in video but it is browser cache) it showed all that stuff but when you clear the cache or goes to profile of newly rejoined you will find everything got deleted that is friends,kudos,replies,images,posts,article and many.