Able to list user's public name, username, phone number, address, facebook ID...

Disclosed: 2018-12-17 22:21:51 By lukeberner To olx
Unknown
Vulnerability Details
Hi, Through api-v2/items you can list all information of users (except email). As items are sequential, you can just make a script that crawls items from: https://www.olx.com.ar/api-v2/items/822200000 to https://www.olx.com.ar/api-v2/items/901858309 Example of sensible user information from random curl: ``` ██████████ ``` ``` █████████ ``` Example of random curl: ``` $ curl https://www.olx.com.ar/api-v2/items/822200000 ██████████ ``` Let me know if you need anything else. Cheers, Luke.-
Actions
View on HackerOne
Report Stats
  • Report ID: 167206
  • State: Closed
  • Substate: resolved
  • Upvotes: 20
Share this report