Loading HuntDB...

Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`

Medium
I
inDrive
Submitted None

Team Summary

Official summary from inDrive

Subscribe to our telegram channel with updates https://t.me/indrive_bbp

Reported by bugsv2

Vulnerability Details

Technical details and impact analysis

Business Logic Errors
## Summary: Hey Kirill, Hope you are doing well today Inshallah <3 I found a bug today allowing to increase the profile rate for the passenger !! Let’s Start reproducing directly .. ## Steps to reproduce: 1. First of all, We gonna create a normal city to city shared ride, Then join it with any normal passenger’s account and complete it .. 2. At the end of the ride, After the passenger marks it as completed, The driver can rate the passenger !! 3. The request is like this: ``` POST /api/v1/reviews/ride/███/driver HTTP/2 Host: intercity-3.eu-east-1.indriverapp.com X-City-Id: 9415 Accept-Language: en_US X-Os-Type: android X-App-Flavor: indriver X-App: android 5.41.1 ██████ Authorization: Bearer █████ Traceparent: ██████ Content-Type: application/json; charset=utf-8 Content-Length: 32 Accept-Encoding: gzip, deflate User-Agent: okhttp/4.10.0 {"message":"Prince","rating":5} ``` 4. Just change the `"rating":5` to any higher number, like: `"rating":55` 5. 200 OK !! 6. and The final profile for the passenger is: ████████ 7. Thank You <3 ## Impact - Getting higher the driver’s profile rate in city to city, **Which is in an application like indriver This should not NEVERRRRR be happened !!**

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Business Logic Errors