Improper email address verifiation while saving Account Details

Disclosed: 2020-03-23 08:31:07 By harshitshah4 To stagingdoteverydotorg
Medium
Vulnerability Details
## Summary: Attacker could be able change its email to any email address even already created another user's email address.(Even though UI doesnot allow it) ## Steps To Reproduce: 0. Set up proxy. 1. Singup with any email address 2. Go to profile section 3. Click on update button 4. Monitor call in reverse proxy and change email field to any user's email address 5. Done! Attacker is able to change its email address to any email address even registered one's ## Supporting Material/References: https://hackerone.com/reports/30975 [list any additional material (e.g. screenshots, logs, etc.)] ## Impact Attacker might be able to impersonate as any other user
Actions
View on HackerOne
Report Stats
  • Report ID: 825646
  • State: Closed
  • Substate: resolved
  • Upvotes: 32
Share this report