inDrive
inDrive 的公开漏洞报告、类别分布与常见资产。
16公开报告
$7,418披露赏金
7漏洞类别
9主要弱点
攻击面
弱点类别分布
主要弱点
常见资产
- *.indrive.comWILDCARD · 5
- *.indriverapp.comWILDCARD · 3
- new-order.eu-east-1.indriverapp.comURL · 2
- terra-*.indriverapp.comWILDCARD · 2
- watchdocs.indriverapp.comURL · 1
- injob.indriver.comURL · 1
- intercity-*.eu-east-1.indriverapp.comWILDCARD · 1
- · 1
高票报告
当前状态 16 份 · 全部 16
- 241Change phone number OTP flaw leads to any phone number takeover业务逻辑 · 2024-10-09 · 严重$2,000业务逻辑错误
- 199Blind SQL injection on id.indrive.comSQL 注入 · 2023-11-24 · 严重$4,134Blind SQL Injection
- 157inDriver Job - Admin Approval Bypass访问控制 · 2023-07-05 · 中危$1,000Incorrect Authorization
- 147#1 XSS on watchdocs.indriverapp.com跨站脚本 · 2024-04-11 · 低危$0反射型 XSS
- 141SSRF in https://couriers.indrive.com/api/file-storage服务端请求伪造 · 2024-01-17 · 高危$0SSRF
- 125Full access to InDrive jira panel via exposed API token信息泄露 · 2023-06-28 · 严重$0信息泄露
- 110Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`业务逻辑 · 2024-07-02 · 中危$0业务逻辑错误
- 101#2 XSS on watchdocs.indriverapp.com跨站脚本 · 2024-04-11 · 中危$0反射型 XSS
- 80Reflected XSS of media.indrive.com跨站脚本 · 2024-07-02 · 中危$0反射型 XSS
- 79# Drivers can access the customers phone number, current location without getting their offer accepted!信息泄露 · 2024-02-19 · 中危$0信息泄露
- 73Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal and more mentioned in the report.访问控制 · 2023-06-28 · 高危$0访问控制缺陷（通用）
- 73Disclosure of users' ip address whenever they view my fright offer on image preview (Without interaction)信息泄露 · 2024-02-19 · 中危$0信息泄露
- 68#3 XSS on watchdocs.indriverapp.com跨站脚本 · 2024-04-11 · 低危$0反射型 XSS
- 66Host Header Injection - internal.qa.delivery.indrive.com注入与走私 · 2024-02-12 · 低危$0Unlabeled
- 47Stored XSS on promo.indrive.com跨站脚本 · 2023-08-28 · 中危$284存储型 XSS
- 43XSS on terra-6.indriverapp.com跨站脚本 · 2024-01-29 · 中危$0反射型 XSS