Uber for Business Allows Administrators to Change Uber Driver Ratings Due to Failure to Authenticate `fast-rating` Endpoint
该报告还没有中文解读。
原文摘录
摘自原文（867 字符中的一小部分）
allows administrators to request a copy of a receipt be emailed to them. This email contains a link to rating trip_token trip_uuid``` (which are contained in the link), I put the link in a text file here: [daviddworken.com/uberRating.txt](daviddworken.com/uberRating.txt). You can confirm that the …
原文中的代码
Furthermore, the link that is supplied does not properly authenticate the user. Anyone who has the link can change the rating without logging in simply by changing the
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Uber 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @ddworken · 版权归作者与 Uber 所有