Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.com #771666 Valid Injection and Smuggling Critical 2020-07-09 – 559 [www.zomato.com] SQLi - /php/██████████ - item_id Analysed #403616 Valid SQL Injection Critical 2018-09-11 $4,500 326 Improper Validation at Partners Login Analysed #990048 Valid Authentication Critical 2021-10-06 $2,000 251 [www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive information Analysed #426165 Valid No weakness recorded Medium 2018-11-28 $550 246 SQL Injection in www.hyperpure.com Analysed #1044716 Valid Command and Code Injection Critical 2021-02-22 $2,000 229 [www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s) Analysed #511044 Valid Input Validation and Logic Medium 2019-03-18 – 229 [www.zomato.com] Blind XSS on one of the Admin Dashboard Analysed #724889 Valid Cross-site Scripting High 2019-11-19 $750 221 Information Disclosure through Sentry Instance ███████ Analysed #697512 Valid Information Disclosure High 2019-09-19 $750 178 Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.json Analysed #952501 Valid SQL Injection Critical 2020-08-10 $2,000 137 [api.zomato.com] Able to manipulate order amount Analysed #512968 Valid Input Validation and Logic High 2019-04-16 – 136 Add upto 10K rupees to a wallet by paying an arbitrary amount Analysed #1408782 Valid Input Validation and Logic High 2022-02-23 $2,000 132 Able to manipulate order amount by removing cancellation amount and cause financial impact Analysed #614523 Valid Input Validation and Logic High 2019-08-16 – 130 Availing Zomato gold by using a random third-party `wallet_id` Analysed #938021 Valid Input Validation and Logic Critical 2020-08-07 $2,000 116 [Zomato Order] Insecure deeplink leads to sensitive information disclosure Analysed #532225 Valid No weakness recorded High 2021-09-23 $750 114 [www.zomato.com] Leaking Email Addresses of merchants via reset password feature Analysed #293490 Valid Access Control – 2021-02-18 – 113 Claiming the listing of a non-delivery restaurant through OTP manipulation Analysed #1330529 Valid Access Control Critical 2022-02-22 $3,250 108 Login to any account with the emailaddress Analysed #245408 Valid Authentication High 2017-08-17 $1,000 103 [www.zomato.com] Blind XSS in one of the admin dashboard Analysed #461272 Valid Cross-site Scripting High 2019-05-01 $500 102 Subdomain takeover of fr1.vpn.zomans.com Analysed #1182864 Valid Input Validation and Logic Medium 2021-09-17 $350 99 Base alpha version code exposure Analysed #167859 Valid Information Disclosure – 2016-10-14 – 99 credentials leakage in public lead to view dev websites Analysed #511440 Valid Information Disclosure Low 2019-03-18 – 78 [www.zomato.com] Tampering with Order Quantity and paying less amount then actual amount, leads to business loss Analysed #403783 Valid Input Validation and Logic High 2018-09-17 – 78 Page has a link to google drive which has logos and a few customer phone recordings Analysed #864712 Valid Cryptography Medium 2022-02-21 $200 76 [https://reviews.zomato.com] Time Based SQL Injection Analysed #300176 Valid SQL Injection Critical 2018-02-02 $1,000 72 [www.zomato.com] Blind SQL Injection in /php/geto2banner Analysed #838855 Valid SQL Injection Critical 2020-08-10 $2,000 68 [Zomato Android/iOS] Theft of user session Analysed #328486 Valid No weakness recorded – 2018-06-17 – 68 IDOR to delete images from other stores Analysed #404797 Valid Insecure Direct Object Reference Low 2018-09-05 $600 67 [www.zomato.com] SQLi on `order_id` parameter Analysed #358669 Valid SQL Injection Critical 2018-05-30 $1,000 63 subdomain takeover on fddkim.zomato.com Analysed #1130376 Valid Access Control Medium 2022-01-27 – 61 [www.zomato.com] Blind XSS in one of the Admin Dashboard Analysed #419731 Valid Cross-site Scripting – 2018-12-03 – 61 [www.zomato.com] Union SQLi + Waf Bypass Analysed #258582 Valid SQL Injection – 2017-09-19 $1,000 61 Open AWS S3 bucket leaks all Images uploaded to Zomato chat Analysed #507097 Valid Authentication Medium 2019-05-01 – 57 [www.zomato.com] Blind SQL Injection in /php/widgets_handler.php Analysed #836079 Valid SQL Injection Critical 2020-08-10 $2,000 54 [Zomato for Business Android] Vulnerability in exported activity WebView Analysed #537670 Valid No weakness recorded Medium 2021-09-23 – 52 [auth2.zomato.com] Reflected XSS at `oauth2/fallbacks/error` | ORY Hydra an OAuth 2.0 and OpenID Connect Provider Analysed #456333 Valid Cross-site Scripting Medium 2019-01-21 – 51 Race condition in User comments Likes Analysed #1409913 Valid Misconfiguration and Insecure Design Low 2022-02-09 – 45 Blind XSS - Report review - Admin panel Analysed #314126 Valid Cross-site Scripting Medium 2018-03-29 $350 41 [www.zomato.com] Boolean SQLi - /█████.php Analysed #297534 Valid SQL Injection – 2018-03-29 $1,000 41 IDOR to cancel any table booking and leak sensitive information such as email,mobile number,uuid Analysed #265258 Valid Insecure Direct Object Reference High 2017-10-22 $250 41 Attacker shall recieve order updates on whatsapp for users who have activated whatsapp notification Analysed #1523584 Valid Input Validation and Logic Medium 2022-04-06 – 37 [www.zomato.com] Boolean SQLi - /███████.php Analysed #301257 Valid SQL Injection – 2018-03-29 $1,000 35 [www.zomato.com/dubai/gold] CRITICAL - Allowing arbitrary amount to become a GOLD Member Analysed #254211 Valid Access Control Medium 2017-10-27 – 34 [www.zomato.com] IDOR - Leaking all Personal Details of all Zomato Users through an endpoint Analysed #269937 Valid Insecure Direct Object Reference High 2017-10-27 – 33 SSRF in https://www.zomato.com████ allows reading local files and website source code Analysed #271224 Valid Server-Side Request Forgery Critical 2018-02-28 – 32 Unauthorised Access to Anyone's User Account Analysed #202921 Valid Authentication Critical 2017-03-28 – 32 Self-Stored XSS - Chained with login/logout CSRF Analysed #632017 Valid Cross-site Scripting Medium 2019-07-03 $300 31 Admin Access to a domain used for development and admin access to internal dashboards on that domain Analysed #271407 Valid Access Control – 2017-12-28 – 31 CORS Misconfiguration on www.zomato.com Analysed #168574 Valid No weakness recorded – 2017-06-30 – 31 Possible to enumerate Addresses of users using AddressId and guessing the delivery_subzone Analysed #514897 Valid Insecure Direct Object Reference Medium 2020-07-15 $1,500 29 [█████████] Hardcoded credentials in Android App Analysed #246995 Valid Authentication Critical 2017-07-19 $500 28