Pornhub: Private videos can be added to our playlists

The researcher discovered a way to add a user's private videos to a different user's playlist by way of a specially crafted request. Note that it is not possible to view another user's private video using this method IDOR/application logic flaw...

Zomato: Use any User to Follow you (Increase Followers) [IDOR]

@hisham found the IDOR issue in the user followback action...

GSA Bounty: [IDOR] The authenticated user can restart website build or view build logs on any another Federalist account

Description Hi. I found an Insecure Direct Object Reference vulnerability on the http://192.168.119.128:1337/v0/build/ endpoint. F200108 When the user wants to restart the build, next request are sent to the endpoint: "site":,"branch":"master" where siteid is numeric ID of the site. However, this...

Shopify: IDOR [partners.shopify.com] - User with ONLY Manage apps permission is able to get shops info and staff names from inside the shop

SUMMARY ---------- Hello, I have found a permission problem in https://partners.shopify.com that allows a member with only "Manage apps" permission to get various show information and also list the staff account from inside that shop without having access the shop's admin area REPLICATION STEPS...

Cuvva: IDOR spam anyone's cellphone number through Cuvva app link

Good afternoon, The following url https://cuvva-alternate.app.link/ITHZI8FrKB?branchflowtype=deepviewtmta&branchflowid=397220061845644344&branchdesktopdeepviewtype=1 can be used to spam phone numbers remotely. Example POC: Send After grabbing the form code I can spam numbers from my desktop, I...

Nextcloud: IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email

Hi Team, I Was Looking around your website and then I found a subdomain newsletter.nextcloud.com on the main page it shows us 3 Options i choose 1st that was Subscribe to our newsletter , Then I click on this Option and I was Taken to https://newsletter.nextcloud.com/?p=subscribe&id=1 The page...

Radancy: IDOR in editing courses

Description This vulnerability consists in : https://mijn.werkenbijdefensie.nl/instellingen/gegevens/ This vulnerability allows an attacker to edit courses that do not belong to him and remove them from the users account. The edited course ends up in the attackers account, but gets deleted from t...

Mail.ru: IDOR in tender.mail.ru leading to Information Disclosure

tender.mail.ru could partially leak information about few organizations with accounts in incomplete registration state. Information leaked was public non confidential organization registry information, such as name, ИНН ITN, ОГРН PSRN, etc. tender.mail.ru is not currently in bug bounty scope...

Open-Xchange: Unauthorized access to attachments details of Private Calendar appointments (Access control issue)

Hi Team, Description : In calendar folder there is a permission settings where user can be assigned as read only user of it's own objects . User with this permission shouldn't be able to view private appointments and it's attachments . There is request of getting attachment details from server...

Uber: Stored XSS on any page in most Uber domains

Due to two IDOR vulnerabilities in Tealium, it was possible to compromise an administrator’s account and inject arbitrary Javascript into https://tags.tiqcdn.com/utag/uber/, which an attacker could leverage for a stored XSS attack on several Uber domains. Additionally, a Tealium user’s password a...

Radancy: Possible to view and takeover other user's education and courses @ mijn.werkenbijdefensie.nl

Domain and URL: https://mijn.werkenbijdefensie.nl/instellingen/gegevens/tab2 Summary: IDOR vulnerability in editing education/courses Description: It is possible to view and change courses and education of other users also known as an IDOR. It's also possible to save these, and after saving the...

ProjectSend r754 Insecure Direct Object Reference / Authenticaton Bypass

Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2031 Release Date: ============= 2017-02-21 Vulnerability Laboratory ID VL-ID:...

ProjectSend r754 - Insecure Direct Object Reference

ProjectSend r754 - Insecure Direct Object Reference Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2031 Release Date: ============= 2017-02-21 Vulnerability...

ProjectSend r754 - IDOR & Authentication Bypass

Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2031 Release Date: ============= 2017-02-21 Vulnerability Laboratory ID VL-ID: ==================================== 2031 Comm...

ProjectSend r754 - IDOR & Authentication Bypass

Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2031 Release Date: ============= 2017-02-21 Vulnerability Laboratory ID VL-ID: ==================================== 2031 Comm...

U.S. Dept Of Defense: Insecure Direct Object Reference (IDOR) vulnerability in a DoD website

A Department of Defense website was vulnerable to an IDOR attack which may allow an attacker to modify web content or certain database parameters. @eugui was able to demonstrate this vulnerability by manipulating web objects in a clever way. Very well done. Thank you!...

Open-Xchange: IDOR - Accessing other user's attachements via PUT /appsuite/api/files?action=saveAs

Hello, I have found a request in witch a user is able to copy other user's pattachements in his own folders and after that, he is able to download them or he is able to email them to another address or able to view them in browser. POC ----------------- PUT...

Rockstar Games: <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->

In this report, the researcher found an insecure direct object reference that allowed a malicious user to impersonate another user in the comment section under Newswire articles. This meant that an attacker could leave abusive comments that appeared to have been made by another user, or delete a...

Open-Xchange: IDOR - Leaking other user's folder names from /appsuite/api/import?action=ICA

Hello, I have found a point in the appointments API import that leaks the folder names from other users or the system folder names. POC ------------------ POST /appsuite/api/import?action=ICAL&folder=6&ignoreUIDs=false&session=56ab07c24398421990bc6820eeeff6cc HTTP/1.1 Host: sandbox.open-xchange.c...

iTechScripts Payment Gateway Script 8.46 SQL Injection

Exploit Title : Payment Gateway Script v8.46 - Multiple Vulnerability Author : Hasan Emre Ozer Google Dork : - Date : 18/01/2017 Type : webapps Platform: PHP Vendor Homepage : http://itechscripts.com/payment-gateway-script/ Sofware Price and Demo : $400 http://payment-gateway.itechscripts.com...