Exploiting a Business Logic Flaw: How an Empty Array Caused Account Lockout and System Pollution
Overview
During a security assessment of a widely-used customer support platform (which shall remain unnamed due to disclosure policies), I discovered a critical business logic vulnerability in the agent invitation API. By manipulating a single param...
hunteramine.hashnode.dev3 min read