Legal Robot · Report #260239
Tampering the mail id on chatbox
Informativestatus
1upvotes
16 Aug 2017disclosed
How it was found
hi sir , i found a vulnerability i.e tampering the data .
steps to reproduce
- login to https://app.legalrobot-uat.com
- open https://app.legalrobot-uat.com/account
- at right side bottom corner , there is a chat symbol.
- just enter the message there , and capture the request using burpsuite and send the request in to repeater tab , after that change the maild owner mail id to some other xxxx mail id and click on send
- at the response tab we will get the response 200 ok.
Thank you sir , hope you understand . here is the poc pics,