Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.com #771666 Valid Injection and Smuggling – 2020-07-09 – 559 [www.zomato.com] SQLi - /php/██████████ - item_id Analysed #403616 Valid SQL Injection – 2018-09-11 $4,500 326 Improper Validation at Partners Login Analysed #990048 Valid Authentication – 2021-10-06 $2,000 251 [www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive information Analysed #426165 Valid No weakness recorded – 2018-11-28 $550 246 SQL Injection in www.hyperpure.com Analysed #1044716 Valid Command and Code Injection – 2021-02-22 $2,000 229 [www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s) Analysed #511044 Valid Input Validation and Logic – 2019-03-18 – 229 [www.zomato.com] Blind XSS on one of the Admin Dashboard Analysed #724889 Valid Cross-site Scripting – 2019-11-19 $750 221 Information Disclosure through Sentry Instance ███████ Analysed #697512 Valid Information Disclosure – 2019-09-19 $750 178 Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.json #952501 Valid SQL Injection – 2020-08-10 $2,000 137 [api.zomato.com] Able to manipulate order amount #512968 Valid Input Validation and Logic – 2019-04-16 – 136 Add upto 10K rupees to a wallet by paying an arbitrary amount #1408782 Valid Input Validation and Logic – 2022-02-23 $2,000 132 Able to manipulate order amount by removing cancellation amount and cause financial impact #614523 Valid Input Validation and Logic – 2019-08-16 – 130 Availing Zomato gold by using a random third-party `wallet_id` #938021 Valid Input Validation and Logic – 2020-08-07 $2,000 116 [Zomato Order] Insecure deeplink leads to sensitive information disclosure #532225 Valid No weakness recorded – 2021-09-23 $750 114 [www.zomato.com] Leaking Email Addresses of merchants via reset password feature #293490 Valid Access Control – 2021-02-18 – 113 Claiming the listing of a non-delivery restaurant through OTP manipulation #1330529 Valid Access Control – 2022-02-22 $3,250 108 Login to any account with the emailaddress #245408 Valid Authentication – 2017-08-17 $1,000 103 [www.zomato.com] Blind XSS in one of the admin dashboard #461272 Valid Cross-site Scripting – 2019-05-01 $500 102 Subdomain takeover of fr1.vpn.zomans.com #1182864 Valid Input Validation and Logic – 2021-09-17 $350 99 Base alpha version code exposure #167859 Valid Information Disclosure – 2016-10-14 – 99 credentials leakage in public lead to view dev websites #511440 Valid Information Disclosure – 2019-03-18 – 78 [www.zomato.com] Tampering with Order Quantity and paying less amount then actual amount, leads to business loss #403783 Valid Input Validation and Logic – 2018-09-17 – 78 Page has a link to google drive which has logos and a few customer phone recordings #864712 Valid Cryptography – 2022-02-21 $200 76 [https://reviews.zomato.com] Time Based SQL Injection #300176 Valid SQL Injection – 2018-02-02 $1,000 72 [www.zomato.com] Blind SQL Injection in /php/geto2banner #838855 Valid SQL Injection – 2020-08-10 $2,000 68 [Zomato Android/iOS] Theft of user session #328486 Valid No weakness recorded – 2018-06-17 – 68 IDOR to delete images from other stores #404797 Valid Insecure Direct Object Reference – 2018-09-05 $600 67 [www.zomato.com] SQLi on `order_id` parameter #358669 Valid SQL Injection – 2018-05-30 $1,000 63 subdomain takeover on fddkim.zomato.com #1130376 Valid Access Control – 2022-01-27 – 61 [www.zomato.com] Blind XSS in one of the Admin Dashboard #419731 Valid Cross-site Scripting – 2018-12-03 – 61 [www.zomato.com] Union SQLi + Waf Bypass #258582 Valid SQL Injection – 2017-09-19 $1,000 61 Open AWS S3 bucket leaks all Images uploaded to Zomato chat #507097 Valid Authentication – 2019-05-01 – 57 [www.zomato.com] Blind SQL Injection in /php/widgets_handler.php #836079 Valid SQL Injection – 2020-08-10 $2,000 54 [Zomato for Business Android] Vulnerability in exported activity WebView #537670 Valid No weakness recorded – 2021-09-23 – 52 [auth2.zomato.com] Reflected XSS at `oauth2/fallbacks/error` | ORY Hydra an OAuth 2.0 and OpenID Connect Provider #456333 Valid Cross-site Scripting – 2019-01-21 – 51 Race condition in User comments Likes #1409913 Valid Misconfiguration and Insecure Design – 2022-02-09 – 45 Blind XSS - Report review - Admin panel #314126 Valid Cross-site Scripting – 2018-03-29 $350 41 [www.zomato.com] Boolean SQLi - /█████.php #297534 Valid SQL Injection – 2018-03-29 $1,000 41 IDOR to cancel any table booking and leak sensitive information such as email,mobile number,uuid #265258 Valid Insecure Direct Object Reference – 2017-10-22 $250 41 Attacker shall recieve order updates on whatsapp for users who have activated whatsapp notification #1523584 Valid Input Validation and Logic – 2022-04-06 – 37 [www.zomato.com] Boolean SQLi - /███████.php #301257 Valid SQL Injection – 2018-03-29 $1,000 35 [www.zomato.com/dubai/gold] CRITICAL - Allowing arbitrary amount to become a GOLD Member #254211 Valid Access Control – 2017-10-27 – 34 [www.zomato.com] IDOR - Leaking all Personal Details of all Zomato Users through an endpoint #269937 Valid Insecure Direct Object Reference – 2017-10-27 – 33 SSRF in https://www.zomato.com████ allows reading local files and website source code #271224 Valid Server-Side Request Forgery – 2018-02-28 – 32 Unauthorised Access to Anyone's User Account #202921 Valid Authentication – 2017-03-28 – 32 Self-Stored XSS - Chained with login/logout CSRF #632017 Valid Cross-site Scripting – 2019-07-03 $300 31 Admin Access to a domain used for development and admin access to internal dashboards on that domain #271407 Valid Access Control – 2017-12-28 – 31 CORS Misconfiguration on www.zomato.com #168574 Valid No weakness recorded – 2017-06-30 – 31 Possible to enumerate Addresses of users using AddressId and guessing the delivery_subzone #514897 Valid Insecure Direct Object Reference – 2020-07-15 $1,500 29 [█████████] Hardcoded credentials in Android App #246995 Valid Authentication – 2017-07-19 $500 28