Mars · Report #2132183
IDOR to account takeover on POST to █████████ by changing member_id parameter
Validstatus
criticalseverity
45upvotes
30 Jan 2024disclosed
Summary
The website endpoint "██████" is exposed to multiple identifier vulnerabilities, which could potentially result in a complete takeover of user accounts. If exploited, malicious actors could gain full control over the victim's account, posing a significant security risk.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.