I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)

Summary

@hk755a found an Insecure Direct Object Reference (IDOR) Vulnerability that allowed an attacker to pay with someone else's registered credit card, while ordering food with Grubhub through the /checkout/transaction_platform endpoint. No credit card information was disclosed as a result of this vulnerability.

This is yet another vulnerability in @hk755a's collection of IDOR reports, and we appreciate their diligent effort in working with the Yelp Security team to prevent others from obtaining free food through our system!

There was an Insecure Direct Object Reference Vulnerability that allowed the attacker to pay from someone else's credit card while purchasing orders (or to be precise, Ordering Food) on yelp through the "/checkout/transaction_platform" endpoint, thus making the order's free for himself. The vulnerability had the potential to affect all the credit cards saved on yelp.com (1,500,000+).

Yelp validated and fixed the vulnerability within a few hours, thus showing their concern for user's security! Special thanks to @Calvinli for sharing credit_card_id which allowed the validation of the bug.