Mars · Report #1947376
███████ ' can delete any animal from other account ' at ██████████
Summary
A vulnerability was present in the ████████████ website that allows an authenticated user to delete animals belonging to other users' accounts. This issue arises due to an Insecure Direct Object Reference (IDOR) vulnerability where the system's authorization mechanism fails to properly validate and restrict access to protected resources based on the user's identity. As a result, a malicious user can manipulate the ██████████████ parameter in the request sent to the ████████████████ endpoint to delete any animal from other users' accounts, leading to unauthorized data deletion.
How it was found
hi team i found ███████████ , i can delete any animal from other account easily
- Go to registration page (████████)
- Verified your account.
- Go to login page and login your account.
For the fastly test, use this credentials to login (my test account)
█████████████████ For Attacker
email: ████████████████ pass: Password
█████████████ For Victim
email: ████ pass: Password
After login i create 2 account for attacker and victim , in the attacker's account, i delete my animal, and i send request to burp .. i change my animal id to victim animal id so i succeeded
███
Impact
████████████████