[www.zomato.com/dubai/gold] CRITICAL - Allowing arbitrary amount to become a GOLD Member

Summary

Hacker was able to find the internal testing Zomato Gold membership.

I was able to purchase the PREMIUM GOLD MEMBERSHIP by selecting the amount of our own choice, here it required two conditions first is that you must have a valid premium membership. So, when I looked up the cost of the membership was something which I wouldn't have afforded to take a risk. So, I decided to play around with the plan_id which was a numeric parameter being passed in the GET REQUEST, so I started Intruder and bruteforced that parameter to find if there are any other plans available, and immediately after few mins I found where it was like I needed to pay 1 AED to become a GOLD Member. Ahh that was cool stuff, so I paid 1 AED and then the UPGRADE PLAN feature had a vulnerability in which the developers were not checking the plan amount, so I selected the plan_id for 1 Year and modified the request with our own amount "0 AED" and succeeded in getting a Premium Membership for 1 year at the cost of 1 AED. That was some interesting find to be honest.

If you still have any questions, hit me up on [Twitter] (https://twitter.com/prateek_0490).

Thanks.