writeups.xyz / Misconfiguration in Change-password Functionality Leads to Account Takeover

Submitter : c2a

Date: 18 April 2021

Bounty : undisclosed

Vulnerabilities :

• IDOR
• Logic Flaw
• Password Reset
• Account Takeover

Programs :

• Undisclosed

Authors :

• Mahmoud Radwan (@0x___2m)
• Mahmoud Samaha (@0x__2m)

Link :
https://0x2m.medium.com/misconfiguration-in-change-password-functionality-leads-to-account-takeover-1314b5507abf