There is a site which hosts coding competitions for coding and placements. They issue certificates for winning the coding exam or at least get into the finale round.
I did not participated in that competition but my friend did. He posted the certificate on LinkedIn with the links of it.
I being on the same coding platform as a user, clicked on the certificate link and was navigated to the certificate page, and BOOM I see my name in the certificate instead of that guy.
Well, I quickly went to incognito mode of the browser and made a fake dummy account, copied and pasted that url and again BOOM, the certificate shows that DUMMY name.
Is it a bug in that coding platform?? with this can I be eligible from bounty?
What is the severity of it knowing that it is Coding and Hiring platform??
What should I call this vulnerability in Technical term?
Note: When I log out from my coding platform account and then click on that link then it says to log in to view the certificate. SO clearly it is related to session in the browser.
The website states the following about eligibility:
Some common security-related issues could include the following:
- Cross-Site Request Forgery (CSRF)
- Cross-Site Scripting (XSS)[Stored XSS/DOM XSS/Reflected XSS which affects other users]
- Code Executions
- SQL injections
- Server Side Request Forgery (SSRF)
- Privilege Escalations
- Authentication Bypasses
- File inclusions (Local & Remote)
- Protection Mechanism bypasses (CSRF bypass, etc.)
- Leakage of sensitive data
- Directory Traversal
- Payment manipulation
- Administration portals without authentication mechanism
- Open redirects which allow stealing tokens/secrets
The following is listed as an example for ineligibility:
- Application stack traces (Path disclosures, etc.)
- Self-type Cross Site Scripting
- Self affecting Reflected Cross Site Scripting
- Denial of Service attacks
- CSRF issues on actions with minimal impact
- Brute force attacks
- Security practices (banner revealing a software version, etc.)
- Vulnerabilities on sites hosted by third parties unless they lead to a vulnerability on the main website.
- Vulnerabilities contingent on physical attack, social engineering, spamming, DDOS attack, etc. V> * ulnerabilities affecting outdated or unpatched browsers / Operating Systems.
- Vulnerabilities in third party applications.
- Bugs that have not been responsibly investigated and reported.
- Bugs already known to us, or already reported by someone else (reward goes to first reporter).
- Issues that aren't reproducible.
- Issues that we can't reasonably be expected to do anything about.
Am I eligible for the bounty?
