HexBrain

Legal Robot · Report #260239

Tampering the mail id on chatbox

Informativestatus
1upvotes
16 Aug 2017disclosed

How it was found

hi sir , i found a vulnerability i.e tampering the data .

steps to reproduce

  1. login to https://app.legalrobot-uat.com
  2. open https://app.legalrobot-uat.com/account
  3. at right side bottom corner , there is a chat symbol.
  4. just enter the message there , and capture the request using burpsuite and send the request in to repeater tab , after that change the maild owner mail id to some other xxxx mail id and click on send
  5. at the response tab we will get the response 200 ok.

Thank you sir , hope you understand . here is the poc pics,

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original