How a single url deleted any account

Hi hackers,

In this post, I will share one of my previous findings on a popular website.As the report itself is not disclosed, let me keep this website as https://www.example.com

When I choose a new target, I first browse the website before doing any recon.I go over all the features it has to offer.

When I opened the website, first thing I saw is of course a login portal which looked like below.

I am very lazy to fill forms, so I always go with social logins.This time, I logged in with my gmail account.I started to browse the website.After few minutes, I started to see my Account Settings
page and then I saw this.

I wanted to see whats going on here.Fired up my Burp and saw the following link without any CSRF protection.
https://www.example.com/social/delete-account?google=true

I was like , REALLY? REALLY? Just this link and it will delete my account ?

So, just to confirm it again, I made a new account using my gmail.In the other tab, I opened that URL and following is what I saw.

I was like WOW! WOW! So, if I send the same link to any person who is already logged in via google, his account will be deleted.BOOM!

Submitted this vulnerability and its resolved in few days 🙂

Hope you enjoyed this post.Stay tuned for more to come 🙂

You can always support me through Paypal!
>>paypal.me/icodechannel<<

Subscribe