Enter: No rate limit which leads to "Users information Disclosure" including verfification documents etc.

HOST api.romit.io Endpoint /v0/cash/auth/login Issue When an attacker tries to login at app.romit.io, he is prompted to enter the PIN . There is no rate limit to verify this. Although there is a an authorization header Authorization: Credential=b67b0b10571ac00444de3cffde0b5b05,...

Enter: Potential for financial loss, negative Values for "Buy fee" and "Sell Fee"

Issue It is possible to set negative values for the Buy Fee and Sell Fee, which will cause unexpected transfers etc. as these settings override the settings at the location. PoC 1. Go to the Operator Wallet's Settings. 2. Click on the users tab. 3. Select any user. 4. Go to settings tab of that...

Enter: Stored XSS in api key of operator wallet

Make an operation wallet 2. Open wallet settings 3. Press "New key" 4. In source code remove "maxlength=30" of key's name input tag - no length check on server-side 5. Fill name input with "asdf" PoC 6. Press "Generate Key" 7. After that when open wallet settings we got XSS. 8. In case we can...