I hacked India's GST portal–11.8M taxpayers exposed; enabling stock manipulation(aseem-shrey.medium.com)

6 pointsby LuD116110 maanden geleden1 comments

aseem-shrey.medium.com

I hacked India's GST portal–11.8M taxpayers exposed; enabling stock manipulation

https://aseem-shrey.medium.com/manipulating-indias-stock-market-the-gst-portal-data-leak-b5437c817071

1 comments

LuD116110 maanden geleden

I found an Insecure Direct Object Reference(IDOR0 security issue that led to leaking GST challans (receipts) of all the 11.8M registered taxpayers. Here's the full story alongwith a video PoC.

Note: No personal data was ever shared or harvested. This was responsibly disclosed to the authorities through proper channels and only after the disclosure timeline (120 days) was it published in the online media.