A CSRF Bug In Paypal Developer Platform Reported By Homam Alhassan

A 14 Year Old Independent Security researcher named Homam Alhassan from Syria send us an info about a Cross Site Request Forgery Attack found in Paypal Developer Platform which allows him to change buyer email address. He thought of selling it before in the Darkweb before he has a second thought of disclosing the CSRF vulnerability to the Paypal Security Team.

Also Read: Bug Hunter Dislcoses A Way To Hack Into Instagram Accounts Through Facebook

You would be given a buyer email and facilitator email by Paypal, When changing his password he was able to exploit other users through the JSON Code.

We asked Homam to send us a Proof of Concept about the CSRF Attack but unfortunately he didn’t do a Video Proof Of Concept, But we have Some Pictures of The Vulnerabilities here with us.

Paypal Developer CSRF POC Pictures By Homam Alhassan

This is the JSON Code Of The Paypal

paypal code

That’s The Message he sent to Paypal about the CSRF Attack

Screen Shot 2016-05-27 at 3.44.22 PM

Then he got response back from Paypay Security Team

Paypal response
He was paid $1,200 by the Paypal Security Team for the bounty.

Did You Have A News To Tell Us about your findings? Send us a mail: [email protected]


Am Shehu Awwal, The Founder Of Techmedia NG, I Like To Write For Fun And Profit Both In Programming And Articles.

Leave a Reply

Your email address will not be published. Required fields are marked *