I am here again with one interesting issue.
This issue deals with the fact that according to the policies of chaturbate, a broadcaster cannot modify the option - Chat Allowed By - until and unless he/she has verified his/her age (default choice is set to all).
This thing could be bypassed and any broadcaster who doesn't have his/her age verified could update this option.
Steps To Reproduce:
- First of all, start broadcasting.
- Click on the gear icon in the chat options to open broadcaster settings.
- Edit any option and intercept the request in Burp Suite.
- Now in that request, replace the value of the parameter allowed_chat with any of the following
- The value would get updated even though the age has not been verified.
Any user who doesn't have his/her age verified can update settings which have been blocked for them.