attacker can book unlimited tickets in free at https://aaf.com/checkout/order-received/21237/?key=wc_order_5bbef48fa35b2
该报告还没有中文解读。
原文摘录
摘自原文（1234 字符中的一小部分）
**Summary:** [add summary of the vulnerability] After looking into https://aaf.com/ i get to know that there is way where i can book a ticket and can play around , but it asked for valid credit card and all stuff so , i tried to bypass and bought a ticket 23 with 0$
原文中的代码
Content-Disposition: form-data; name="addon-268-number-of-seats-0" 10-seats-10
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Alliance of American Football 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @gujjuboy10x00 · 版权归作者与 Alliance of American Football 所有