Loading HuntDB...

Improper email address verifiation while saving Account Details

Medium
S
Staging.every.org
Submitted None
Reported by harshitshah4

Vulnerability Details

Technical details and impact analysis

Violation of Secure Design Principles
## Summary: Attacker could be able change its email to any email address even already created another user's email address.(Even though UI doesnot allow it) ## Steps To Reproduce: 0. Set up proxy. 1. Singup with any email address 2. Go to profile section 3. Click on update button 4. Monitor call in reverse proxy and change email field to any user's email address 5. Done! Attacker is able to change its email address to any email address even registered one's ## Supporting Material/References: https://hackerone.com/reports/30975 [list any additional material (e.g. screenshots, logs, etc.)] ## Impact Attacker might be able to impersonate as any other user

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Violation of Secure Design Principles