HexBrain

Mars · Report #2445106

CSRF in Delete Pet Function

Validstatus
mediumseverity
32upvotes
19 Nov 2024disclosed

Summary

A Cross-Site Request Forgery (CSRF) vulnerability is identified in the Delete Pet functionality on the ████████ platform. The vulnerability is discovered in the pet deletion endpoint which can be exploited by manipulating the pet ID parameter. When exploited, an attacker can force authenticated users to delete their pets without their knowledge or consent by simply having them visit a maliciously crafted webpage containing the CSRF payload.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original