- Account: the twitter account id
- ID: the credit card id and it’s numerical without any alphabetic characters
“All I had to do is to change those two parameters to my other twitter account id and credit card id , then reply again the request and I suddenly found that credit card have been delete from the other twitter account without any required interaction,” Aboul-Ela wrote.
“I thought it have the same effect of deleting, so I tried to add invalid credit card again and intercepted the request,” he said.Unlike first vulnerability, the account parameter doesn’t exists, only credit card Id is used. He modified the credit card Id in the URL and body to his credit card Id from other twitter account and then replied the request.
“The impact of the vulnerability was very critical and high because all what’s needed to delete credit card is to have the credit card identifier which consists only of 6 numbers such as “220152,″ said Aboul-Ela.