Bykea

Bykea 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 不安全的直接对象引用5
• 业务逻辑3
• 信息泄露2
• 访问控制1

主要弱点

• IDOR5
• 业务逻辑错误3
• 访问控制缺陷（通用）1
• Inclusion of Sensitive Information in an Include File1
• LLM06: Sensitive Information Disclosure1

常见资产

• *.bykea.netWILDCARD · 5
• https://api.bykea.netURL · 4
• com.bykea.pkGOOGLE_PLAY_APP_ID · 2

高票报告

当前状态 11 份 · 全部 11

1. 128
   IDOR on in-app hardcoded zombie endpoint不安全的直接对象引用 · 2025-06-13 · 中危
   $0IDOR
2. 108
   Broken Access Control (IDOR) in Booking Detail and Bids Could Leads to Sensitive Information Disclosure不安全的直接对象引用 · 2025-06-13 · 高危
   $0IDOR
3. 97
   Critical Information Disclosure via /talos/api/v1/files/upload信息泄露 · 2025-09-18 · 严重
   $0Inclusion of Sensitive Information in an Include File
4. 80
   Improper Access Control Allows Trip Hijacking and Passenger/Driver PII Disclosure不安全的直接对象引用 · 2025-06-26 · 中危
   $0IDOR
5. 76
   Ability to increase any customer offered fare (BAC)不安全的直接对象引用 · 2025-06-13 · 中危
   $0IDOR
6. 64
   Exposed trip_no in WebSocket Responses Leading to Excessive information Disclosure访问控制 · 2025-06-26 · 中危
   $0访问控制缺陷（通用）
7. 63
   Bypassing Bronze Partner Wallet Restriction to Accept Trips with Negative Balance业务逻辑 · 2025-06-13 · 中危
   $0业务逻辑错误
8. 60
   Lack of Feedback Validation Permits Arbitrary Driver Ratings不安全的直接对象引用 · 2025-06-12 · 中危
   $0IDOR
9. 55
   Lack of minimum value bid wheel verification on customer_bid in Rental Trips业务逻辑 · 2025-11-20 · 低危
   $0业务逻辑错误
10. 49
    Customer can cancel a individual booking in a batch, causing locking of partner.业务逻辑 · 2025-11-20 · 中危
    $0业务逻辑错误
11. 43
    MongoDB Query Logs & Schema Leak via Unauthenticated Endpoint信息泄露 · 2025-09-17 · 低危
    $0LLM06: Sensitive Information Disclosure