How I Found and Bypassed a Newsletter Confirmation System (IDOR). I Almost Ignored This… Until It Turned Into a High Severity IDOR. I go by kjulius, a self-taught Ethical Hacker. 🪞🗿 🌱 It …

InfoSecWriteUps' platform is  dedicated to providing insights and resources for cybersecurity professionals and enthusiasts. Through articles, tutorials, and security research, InfoSecWriteUps offers insights into cybersecurity vulnerabilities, attack techniques, and defense strategies. Readers can learn about penetration testing, threat intelligence, and incident response to enhance their cybersecurity knowledge and skills.

InfoSec Write-ups

A bug bounty writeup describing the discovery of an Insecure Direct Object Reference (IDOR) vulnerability in a newsletter confirmation system. The researcher noticed sequential p_id parameters in confirmation links, and after an initial failed attempt at swapping IDs, discovered that removing the hash parameter entirely bypassed all verification — allowing anyone to confirm subscriptions for arbitrary email addresses without inbox access. The impact included potential mass unauthorized subscriptions, spam abuse, and phishing risks.