Able to list user's public name, username, phone number, address, facebook ID...
Unknown
Vulnerability Details
Hi,
Through api-v2/items you can list all information of users (except email). As items are sequential, you can just make a script that crawls items from:
https://www.olx.com.ar/api-v2/items/822200000
to
https://www.olx.com.ar/api-v2/items/901858309
Example of sensible user information from random curl:
```
██████████
```
```
█████████
```
Example of random curl:
```
$ curl https://www.olx.com.ar/api-v2/items/822200000
██████████
```
Let me know if you need anything else.
Cheers,
Luke.-
Actions
View on HackerOneReport Stats
- Report ID: 167206
- State: Closed
- Substate: resolved
- Upvotes: 20