Mars · Report #2445106
CSRF in Delete Pet Function
Validstatus
mediumseverity
32upvotes
19 Nov 2024disclosed
Summary
A Cross-Site Request Forgery (CSRF) vulnerability is identified in the Delete Pet functionality on the ████████ platform. The vulnerability is discovered in the pet deletion endpoint which can be exploited by manipulating the pet ID parameter. When exploited, an attacker can force authenticated users to delete their pets without their knowledge or consent by simply having them visit a maliciously crafted webpage containing the CSRF payload.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.