Mail.ru: [api.pandao.ru] IDOR позволяет изменять адрес любого пользователя

2019-01-22T22:46:27
ID H1:484339
Type hackerone
Reporter eremeev
Modified 2019-03-11T13:14:28

Description

IDOR in deliveryProfiles API of pandao.ru marketplace allowed to change delivery address of arbitrary user

On the time of reporting, pandao.ru runs temporary pre-bug bounty competition program with $1000 bounties for vulnerabilities related to money/points/orders manipulation