Uber · Report #168453
Users can falsely declare their own Uber account info on the monthly billing application
Summary
When applying for monthly billing, statistics and data regarding account usage that was fetched and subsequently submitted could be tampered with. This data would be reviewed by a human making a credit decision, potentially influencing their decision inappropriately in favor of the applicant.
When applying for monthly billing (a line of credit), it was possible to intercept the request made to get your Uber account statistics (i.e. how many trips you've taken, total spend, etc...) and change this, which could possibly affect (in your favor) the outcome of a credit check. Overall, this was well handled by the taxi drivers and I am happy to keep my personal rating for Uber bug bounty...........10 out of 10.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.