Mars · Report #2756402
█████████ when adding branches to your account
Validstatus
criticalseverity
98upvotes
26 Nov 2024disclosed
Summary
A vulnerability has been identified in the branch addition functionality of the Royal Canin specialized channel website ██████████. The issue is classified as an Insecure Direct Object Reference (IDOR) vulnerability, which allows unauthorized users to add branches to any account by manipulating the customer's routing number (RUT) in the request parameter.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.