Change phone number OTP flaw leads to any phone number takeover Analysed #2588329 Valid Input Validation and Logic Critical 2024-10-09 $2,000 241 Blind SQL injection on id.indrive.com #2051931 Valid SQL Injection – 2023-11-24 $4,134 199 inDriver Job - Admin Approval Bypass #1861487 Valid Access Control – 2023-07-05 $1,000 157 #1 XSS on watchdocs.indriverapp.com #2014955 Valid Cross-site Scripting – 2024-04-11 – 147 SSRF in https://couriers.indrive.com/api/file-storage #2300358 Valid Server-Side Request Forgery – 2024-01-16 – 141 Full access to InDrive jira panel via exposed API token #1785145 Valid Information Disclosure – 2023-06-28 – 125 Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver` #2125049 Valid Input Validation and Logic Medium 2024-07-02 – 110 #2 XSS on watchdocs.indriverapp.com #2015074 Valid Cross-site Scripting – 2024-04-11 – 101 Reflected XSS of media.indrive.com #2503113 Valid Cross-site Scripting Medium 2024-07-02 – 80 # Drivers can access the customers phone number, current location without getting their offer accepted! #1785079 Valid Information Disclosure – 2024-02-19 – 79 Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal and more mentioned in the report. #1960107 Valid Access Control – 2023-06-28 – 73 Disclosure of users' ip address whenever they view my fright offer on image preview (Without interaction) #1782467 Valid Information Disclosure – 2024-02-19 – 73 #3 XSS on watchdocs.indriverapp.com #2028265 Valid Cross-site Scripting – 2024-04-11 – 68 Host Header Injection - internal.qa.delivery.indrive.com #2076786 Valid No weakness recorded – 2024-02-12 – 66 Stored XSS on promo.indrive.com #2051085 Valid Cross-site Scripting – 2023-08-28 $284 47 XSS on terra-6.indriverapp.com #1969696 Valid Cross-site Scripting – 2024-01-29 – 43