Mars · Report #2402010
Attacker can add two free bags offered by the site at the same time.
Validstatus
mediumseverity
62upvotes
25 Jun 2024disclosed
Summary
A vulnerability was found on the website "███████" that allows an attacker to add two free bags offered by the site simultaneously, despite the restriction of choosing only one. This is achieved by manipulating the API responsible for adding the free bags to the cart.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.