address-enumeration

1 article
sort: new top best
clear filter
0 5/10

An IDOR vulnerability in an e-commerce site's address management API exposed customer addresses and mobile numbers. Although direct address retrieval was protected by session validation, the attacker discovered that a POST request to set a default address with sequential address_id parameters returned HTTP 200 responses, and subsequent checkout page requests displayed other users' full addresses regardless of session context.

Rahul Varale PortSwigger
rahulvarale.medium.com · kh4sh3i/bug-bounty-writeups · 4 hours ago · details