RBKmoney · Report #281296
IDOR in merchant.rbmonkey.com allows deleting eShops of another user
Validstatus
highseverity
15upvotes
29 Jan 2018disclosed
Summary
Website merchant.rbmonkey.com was exposed to an insecure direct object reference vulnerability (IDOR) which may allow an attacker to deleting shop objects of another user.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.