A 14 Year Old Independent Security researcher named Homam Alhassan from Syria send us an info about a Cross Site Request Forgery Attack found in Paypal Developer Platform which allows him to change buyer email address. He thought of selling it before in the Darkweb before he has a second thought of disclosing the CSRF vulnerability to the Paypal Security Team.
You would be given a buyer email and facilitator email by Paypal, When changing his password he was able to exploit other users through the JSON Code.
We asked Homam to send us a Proof of Concept about the CSRF Attack but unfortunately he didn’t do a Video Proof Of Concept, But we have Some Pictures of The Vulnerabilities here with us.
Paypal Developer CSRF POC Pictures By Homam Alhassan
This is the JSON Code Of The Paypal
That’s The Message he sent to Paypal about the CSRF Attack
Then he got response back from Paypay Security Team
He was paid $1,200 by the Paypal Security Team for the bounty.
Did You Have A News To Tell Us about your findings? Send us a mail: [email protected]