WRITEUP #5948

[Responsible disclosure] How I could have booked movie tickets through other user accounts

Auth BypassPassword resetAccount takeoverBruteforceOTP bypass

byBharathvaj Ganesan

Program

AGS Cinemas

Published

Jun 18, 2018

Added to HackDex

Sep 15, 2022

Read Full Writeuphttps://medium.com/bugbountywriteup/responsible-disclosure-how-i-could-have-booked-movie-tickets-through-other-user-accounts-2db26a037b4c

▸ RELATED WRITEUPS

Unlocking the Weak Spot: Exploiting Insecure Password Reset Tokens

RCEBruteforce

Interesting Story of an Account Takeover Vulnerability

Auth BypassAccount takeover

Instagram and Meta 2FA Bypass by Unprotected Backup Code Retrieval in Accounts Center

Auth Bypass2FA / MFA bypass

Forced SSO Session Fixation

Auth BypassSSO

Account takeover on 8 years old public program

Auth BypassAccount takeover

Built with ❤️ by Shubham Rawat