writeups.xyz / How we tried to book a train ticket and ended up with a databreach with 245,000 records

Submitter : c2a

Date: 19 June 2023

Bounty : undisclosed

Vulnerabilities :

• Subdomain Takeover
• Password Reset
• Logic Flaw
• Broken Access Control

Programs :

• DiscoverEU

Authors :

• Zerforschung (@Zerforschung)

Link :
https://zerforschung.org/posts/freundschaftspass-en/