writeups.xyz / Rewriting a photo not owned by the session user in Moments App (Revisited)

Submitter : c2a

Date: 27 October 2016

Bounty : undisclosed

Vulnerabilities :

• Logic Flaw
• Broken Authorization

Programs :

• Meta / Facebook

Authors :

• Philippe Harewood (@Phwd)

Link :
https://philippeharewood.com/rewriting-a-photo-not-owned-by-the-session-user-in-moments-app-revisited/