HexBrain

CS Money · Report #993767

Improper authentication in the load sell inventory page

Informativestatus
3upvotes
8 Oct 2020disclosed

How it was found

Summary:

Hello team,

I found an endpoint response all data relate to sell mode inventory that doesn't have improper authentication in the link: https://cs.money/load_sell_mode_inventory

Steps To Reproduce:

[add details for how we can reproduce the issue]

  1. Open directly the link: https://cs.money/load_sell_mode_inventory
  2. Observe the result

Supporting Material/References:

  • [attachment / reference]

Impact

All most data in the site to view then user have to login the first. I think that you are missing authentication for these pages.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original