Race Condition on "Get free Badoo Premium" which allows to get more days of free premium for Free.
该报告还没有中文解读。
原文摘录
摘自原文（2638 字符中的一小部分）
Summary: On Badoo when a user wants to delete his account it prompts for a Free 3 days premium or the user can proceed to delete his account. But when user choose to get free 3 day premium he can click `Get free Badoo Premium` and can enjoy free premium for three days, Here i found a race condition …
原文中的代码
POST /webapi.phtml?SERVER_PROMO_ACCEPTED HTTP/1.1 Host: eu1.badoo.com Connection: close Content-Length: 190 X-Session-id: s1:77:████ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 X-Message-type: 402 X-User-id: █████████ …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Bumble 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @th4nu_0x0 · 版权归作者与 Bumble 所有