Information Disclosure That Lead To User Data Leak | p1 bug

Glad You're Here!

Lets Unlock the secrets of Information Disclosure That Lead To User Data Leak with our expert guides

 

Hacking Aspirants, I am System.Exit

 

 Information disclosure is when a web application fails to properly protect confidential information, which causes revealing sensitive information or data of the users or anything related to users to any third party.
 

Summary:

To get any MTN users data such as FULL NAME, CUSTOMER TYPE AND PICTURE.  get those data by using only phone number of any MTN users.
VUL URL: https://mtnautotopup.mtnonline.com/autotopup/app/sign-up-phone

VUL URL: https://197.210.3.135/autotopup/app/sign-up-phone

NOTE: Tested with a Nigeria phone number that belong to somebody.
 

Steps To Reproduce:

1.  Visit `https://mtnautotopup.mtnonline.com/autotopup/app/sign-up-phone` or `https://197.210.3.135/autotopup/app/sign-up-phone`
2.  Put in a phone number and catch the request via BURP
3.  INTERCEPT the request of `GET /vtu-service/api/pwa/pub/get-bio-data/081*******`
4.  The response contains Fullname, Customer Type and Picture of the user.

Supporting Material/References:

VUL REQUEST:

 

RESPONSE:

NOTE: I replaced the exposed data with EXPOSE.

 

Impact

An attacker can retrieve any users data (like full name, Customer Type, and Picture) by just using the victim phone number. This can be use for information gathering about someone for malicious use or criminal activity.

Reported By

Netboy Submitted a report to MTN Group  On HackerOne

 

I couldn't have done this without readers like you. Thank you for reading and for your support, it's truly appreciated.