Uber · Report #624645
Chained vulnerabilities create DOS attack against users on desafio5estrelas.com
Validstatus
lowseverity
$1,000bounty
17upvotes
30 Mar 2021disclosed
Summary
On a vendor created and managed site desafio5estrelas.com, by controlling the value of the gender parameter on the /salvar_genero endpoint via CSRF, an attacker was able to prevent a user from ever logging into their account again.
Fun chained CSRF that caused a DOS on user’s account.
Check out my blog https://healdb.tech/blog/ or my Twitter https://twitter.com/heald_ben for some Bug Bounty tool releases and blogs!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.