Business Logic Flaw - A non premium user can change/update retailers to get cashback on all the retailers associated with Curve
该报告还没有中文解读。
原文摘录
摘自原文（3377 字符中的一小部分）
While testing your android application I've found a business logic flaw by using which a non premium user can update/change the retailers when ever and what ever retailers he wants to.
原文中的代码
GET /v1/rewards/users/programs/e329e463-7f5d-4358-9109-4f97c9f86abd/merchants HTTP/1.1 Accept: application/json Curve-UserAgent: Android;Genymotion;Custom Phone Curve-AppAndVersion: Curve Android 2.9.0 crv-user-agent: Android 2.9.0/20900 Authorization: APE7kg446BXw2iFEI6Ca079RaGrJ3bcelA9DKDoUFUA …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Curve 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @praseudo7 · 版权归作者与 Curve 所有