Mars · Report #2261600
CSRF to delete a pet on ██████
Validstatus
lowseverity
61upvotes
5 Feb 2024disclosed
Summary
The /pets/delete endpoint on ████ is susceptible to Cross-Site Request Forgery (CSRF) attacks. This vulnerability enables an attacker to delete a pet from the targeted user's account. The issue arises from a CSRF problem in both GET and POST requests at the endpoint ████, allowing unauthorized deletion of pets.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.