search

acikyazilimagi / deprem-yardim-com

https://depremyardim.com/
Apache License 2.0
25 stars 7 forks source link

bug: Information Disclosure #30

Closed yusufmeteyilmaz closed 1 year ago

yusufmeteyilmaz commented 1 year ago

Error Description: You can intercept and change the value of "per page" value (which is bottom of to screen) to whatever you want and receive all entered data.

Discord username: toooboring#1074

Error Environment: depremyardim.com/livewire/message/injured-table

Describe how you got the error step by step:

  1. Go to https://depremyardim.com/
  2. Click show all. image
  3. Turn Intercept to on (I used burp it depends which proxy you are using) image
  4. Select a value. image
  5. Check your request image
  6. Send it to Repeater image
  7. Scroll down until you see "value" image
  8. Change value and send it. image image

Important Note: If you do not think that your computer can handle such amount data, do not enter a high value, burp would crash.

Expected Behaviour: There should be a limitation in the back end.

Operating System: Fedora 37 Browser [Chromium] Version [110.0.5481.77 (Official Build) (64-bit)]

Additional Context: Setting the limit to 100 seems viable.

FurkanGM commented 1 year ago

fixed with #31