Mail.ru: [pandao.ru] Возможность списания несуществующих бонусных баллов

2019-01-23T12:10:32
ID H1:484634
Type hackerone
Reporter hudmi
Modified 2019-03-05T09:00:58

Description

Race condition (TOCTOU) in pandao.ru marketplace allowed to use bonus points more than once.

On the time of reporting, pandao.ru runs temporary pre-bug bounty competition program with $1000 bounties for vulnerabilities related to money/points/orders manipulation