Loading HuntDB...

Page has a link to google drive which has logos and a few customer phone recordings

Medium
Z
Zomato
Submitted None
Reported by codersanjay

Vulnerability Details

Technical details and impact analysis

Cleartext Storage of Sensitive Information
**Description:** * Go to ███████ Refer to the screenshot below ██████ As you can see in the above image, there is is link to access zomato logos.This redirected me to a google drive page which not only had logos but also customer care recordings where sensitive information like **Customer mobile numbers,customer names,what food they ordered,order id's** were disclosed. Refer to the screenshot below. ███ Now go to **recordings** folder. ██████ As you can see in the above image,there are about 35 recordings wherein sensitive information is being disclosed.I guess everything is uploaded yesterday (May 1st). I suspect there would be more of a recordings added to this folder as I see a folder named **Till Date Recordings** which is empty as of now. ## Steps To Reproduce: 1. Go to Go to █████ 2.Click on the google drive link for logos 3.Go to recordings folder 4.Find all customercare recordings ## Supporting Material/References: The following is one of the audio recording found wherein customer number,name is disclosed. * ██████████ ## Impact Sensitive PII disclosure.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$200.00

Submitted

Weakness

Cleartext Storage of Sensitive Information