Profile Avatar Unlock vulnerability

hey,

so while testing a private program, i found an interesting thing on profile change, so i try to change avatar there a so many avatar’s but most of are locked, so i can’t use them, but mujhe tu vahi karna hai jiske liya mujhe roka jaye,

so i choose normal avatar ju unloacked tha, capture request in burpsuit

so now did a thing more, go to inspect and copy the name of locked avatar

so now i just replace the name of locked avatar with unlocked avatarin request

now forward and ……

dekhaaa…..

but jispe bug mila vo domain hi out of scope hai

koi chup karwado pls. 💔😭😭😭😭😭

“mai dhundne ko jamane mai, jab waffa niklaaa aa a…..”

chalo agle blog mai milege,

“Comment na karne walon, tumhara per gobar par padh jaye!” 🐄💩

“Like na karne walon, tumhara bhi” 💩🔥