Chaturbate · Report #411620
Form Replay in customer information form
Validstatus
mediumseverity
16upvotes
11 Jan 2019disclosed
Summary
The hacker found that the server replays some form field data back in the response when there were form validation errors, which could be cached or viewed by someone with physical access to the same device used to complete the form. The fix was to delete the form data from showing in the response. The target was https://billingsupport.chaturbate.com/customer_support/information_form/
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.