HexBrain

Chaturbate · Report #411620

Form Replay in customer information form

Validstatus
mediumseverity
16upvotes
11 Jan 2019disclosed

Summary

The hacker found that the server replays some form field data back in the response when there were form validation errors, which could be cached or viewed by someone with physical access to the same device used to complete the form. The fix was to delete the form data from showing in the response. The target was https://billingsupport.chaturbate.com/customer_support/information_form/

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original