Sep 16, 2014
At the beginning of this month, just like other social networks, Twitter also started paying individuals for any flaws they uncover on its service with a fee of $140 or more offered per flaw under its new Bug Bounty program, and here comes the claimant. An Egyptian Security Researcher, Ahmed Mohamed Hassan Aboul-Ela , who have been rewarded by many reputed and popular technology giants including Google, Microsoft and Apple, have discovered a critical vulnerability in Twitter's advertising service that allowed him deleting credit cards from any Twitter account. FIRST VULNERABILITY Initially, Aboul-Ela found two different vulnerabilities in ads.twitter.com, but both the flaws was having the " same effect and impact. " First flaw exists in the Delete function of credit cards in payments method page, https://ads.twitter.com/accounts/[account id]/payment_methods By choosing the Delete this card function, an ajax POST request is sent to the server. The post parameters se