500$ Idor vulnerability.

It was a shopping website , selling products , t-shirts and somethings like that , When you add a product to your shopping cart , there is a request with “product_id” parameter to fetch the product data , i think that what if there is a non released products , a private ones that they don’t want to disclsose them public now.

So i send the request to Burp intruder , put the combo list from 1–1000 , and guess what i got hits!

Timeline:

Reported October 23, 2024

Triaged and Bounty October 25, 2024