Loading HuntDB...

Race Condition in Redeeming Coupons

I
Instacart
Submitted None
Reported by cablej

Vulnerability Details

Technical details and impact analysis

Violation of Secure Design Principles
Hello, There exists a race condition in redeeming coupons, allowing a user to redeem the same coupon multiple times, and stacking savings added. This allows for a user to get virtually any discount. POC: 1. Visit your account and select 'Promo Codes'. 2. Select redeem promo code, and add any promo code. For example, I found the code 'dallas20'. 3. Intercept the request using a proxy, and make the request multiple times, asynchronously. 4. The code will be redeemed multiple times. For an example, see the screenshot attached.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Violation of Secure Design Principles