Nir Goldshlager, founder of Breaksec and Security Researcher reported critical flaws in Paypal Reporting system that allowed him to steal private data of any PayPal account.
Exploiting the vulnerabilities he discovered, allowed him to access the financial information of any PayPal user including victim's shipping address Email addresses, Phone Number, Item name, Item Amount, Full name, Transaction ID, Invoice ID, Transaction, Subject, Account ID, Paypal Reference ID etc.
He found that PayPal is using the Actuate Iportal Application (a third party app) to display customer reports, so Nir downloaded the trial version of this app for testing purpose from its official website.
Nir found that, Getfolderitems.do file having an ID parameter of 7-8 numeric characters which can be manipulated get the secret token id of respective user with same ID. i.e getfolderitems.do?id=392302.
After getting the secret token ID of victim's account, he use the folder parameter i.e getfolderitems.do?folder=/users/secretokenidoftheuser to access victim's private data, because Paypal blocked access to the users folder directly without token i.e getfolderitems.do?folder=/users/.