HexBrain

Dropcontact · Report #963546

User registration using public domain email like gmail in place of professional email.

Validstatus
mediumseverity
8upvotes
24 Aug 2020disclosed

Summary

Like sais in the title, we were only checking and restricting professional email in frontend, which led to being able to register with an email which is not pro because we were not checking this info in the backend.

User was able to register with public domain email like gmail by response modification. Thanks to the team for a quick fix.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original