Social media account takeover

How it was found

Summary:

I found a social media account takeover Vulnerability at https://simfy.africa/ which lead me to takeover the Instagram account of that website so when any user or visitor want to visit the company Instagram he will land at my Instagram page and from here i can start phishing or Spreading misleading information and that will break users trust in your platform

Steps To Reproduce:

1.visit https://simfy.africa and scroll down

2.you will see social media account click on Instagram and you will be redirected to my Instagram account

PoC : video in the attachments

Impact

1.Misinformation and Reputation Damage: False information: An attacker could use the hijacked page to spread false information or misinformation about the company, potentially damaging its reputation. Negative sentiment: Users who encounter the hijacked page might associate negative feelings with the company, leading to a decline in trust and customer satisfaction.

2.Phishing Attacks: Malicious links: The attacker could post malicious links or content on the hijacked page, tricking unsuspecting users into clicking on them. Data theft: Clicking on these links could lead to users' personal information or credentials being compromised.

3.Brand Impersonation: Scamming: The attacker could use the hijacked page to impersonate the company and attempt to scam users, such as by requesting payments or personal information. Lost trust: This can erode trust in the company's online presence and make it difficult to rebuild.

4.Business Disruption: Customer inquiries: The hijacked page could be flooded with inquiries from concerned users, diverting resources and attention away from legitimate business activities. Lost revenue: In severe cases, the damage to the company's reputation could lead to a decline in sales and revenue.