XSS on terra-6.indriverapp.com #1969696 Valid Cross-site Scripting – 2024-01-29 – 43 Stored XSS on promo.indrive.com #2051085 Valid Cross-site Scripting – 2023-08-28 $284 47 Host Header Injection - internal.qa.delivery.indrive.com #2076786 Valid No weakness recorded – 2024-02-12 – 66 #3 XSS on watchdocs.indriverapp.com #2028265 Valid Cross-site Scripting – 2024-04-11 – 68 Disclosure of users' ip address whenever they view my fright offer on image preview (Without interaction) #1782467 Valid Information Disclosure – 2024-02-19 – 73 Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal and more mentioned in the report. #1960107 Valid Access Control – 2023-06-28 – 73 # Drivers can access the customers phone number, current location without getting their offer accepted! #1785079 Valid Information Disclosure – 2024-02-19 – 79 Reflected XSS of media.indrive.com #2503113 Valid Cross-site Scripting Medium 2024-07-02 – 80 #2 XSS on watchdocs.indriverapp.com #2015074 Valid Cross-site Scripting – 2024-04-11 – 101 Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver` #2125049 Valid Input Validation and Logic Medium 2024-07-02 – 110 Full access to InDrive jira panel via exposed API token #1785145 Valid Information Disclosure – 2023-06-28 – 125 SSRF in https://couriers.indrive.com/api/file-storage #2300358 Valid Server-Side Request Forgery – 2024-01-16 – 141 #1 XSS on watchdocs.indriverapp.com #2014955 Valid Cross-site Scripting – 2024-04-11 – 147 inDriver Job - Admin Approval Bypass #1861487 Valid Access Control – 2023-07-05 $1,000 157 Blind SQL injection on id.indrive.com #2051931 Valid SQL Injection – 2023-11-24 $4,134 199 Change phone number OTP flaw leads to any phone number takeover Analysed #2588329 Valid Input Validation and Logic Critical 2024-10-09 $2,000 241