HexBrain

Uber · Report #168453

Users can falsely declare their own Uber account info on the monthly billing application

Validstatus
7upvotes
20 Oct 2016disclosed

Summary

When applying for monthly billing, statistics and data regarding account usage that was fetched and subsequently submitted could be tampered with. This data would be reviewed by a human making a credit decision, potentially influencing their decision inappropriately in favor of the applicant.

When applying for monthly billing (a line of credit), it was possible to intercept the request made to get your Uber account statistics (i.e. how many trips you've taken, total spend, etc...) and change this, which could possibly affect (in your favor) the outcome of a credit check. Overall, this was well handled by the taxi drivers and I am happy to keep my personal rating for Uber bug bounty...........10 out of 10.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original