Twitter Vulnerability Allows Hacker to Delete Credit Cards from Any Twitter Account

Status
Not open for further replies.

Petrovic

Level 64
Thread author
Verified
Honorary Member
Top Poster
Well-known
Apr 25, 2013
5,354
FIRST VULNERABILITY
Initially, Aboul-Ela found two different vulnerabilities in ads.twitter.com, but both the flaws was having the “same effect and impact.” First flaw exists in the Delete function of credit cards in payments method page, https://ads.twitter.com/accounts/[account id]/payment_methods
By choosing the Delete this card function, an ajax POST request is sent to the server. The post parameters sent in request body are:

  • Account: the twitter account id
  • ID: the credit card id and it’s numerical without any alphabetic characters
All I had to do is to change those two parameters to my other twitter account id and credit card id , then reply again the request and I suddenly found that credit card have been delete from the other twitter account without any required interaction,” Aboul-Ela wrote.
The page response was “403 forbbiden” but in actual, the credit card was deleted from the account.

SECOND VULNERABILITY
Aboul-Ela found another similar flaw in ads.twitter.com, but according to him, the impact of the this vulnerability was higher than the previous one.


When he tried to add an invalid credit card to his twitter account, it displayed an Error message “We were unable to approve the card you entered” and serve “Dismiss” button. Clicking on the button, the credit card was disappeared from his account.

“I thought it have the same effect of deleting, so I tried to add invalid credit card again and intercepted the request,” he said. Unlike first vulnerability, the account parameter doesn’t exists, only credit card Id is used. He modified the credit card Id in the URL and body to his credit card Id from other twitter account and then replied the request.

Full Article
 
  • Like
Reactions: amz
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top