Paypal- Privilege Escalation Vulnerability [Delete Any User]

Vulnerability Type: Privilege Escalation

Vulnerable Website:

Status: Fixed

Vulnerability Overview: This vulnerability allowed an attacker to delete any user registered in


I forgot to take screenshots but I am sure my detail write-up will clear everything.

First of all I registered here-

I had to login with my own Paypal account and then set the username. For e.g. sehgal

So, my account page was-

Then after heading to account settings page, I found that there was a option to delete our own account.

Deletion link of my account was-

where "2134" was my User-ID.

I tried to change the "2134" value to someone's else User-ID and sent the request.

Arghh! Error.. I was unable to delete it. Nevermind, no token was passed while request.


So, I continued testing and came with very cool link. :)

Remember my deletion link? 

It was-

I tried to modify URL a bit. Put "admin" in place of my username. I tried to delete the user with User-ID 2145. Final link becomes like this-

BOOM! User got deleted. Edit URL and change "id" attribute to any USER-ID and it will delete the user without any verification.

Paypal rewarded me with 2000$ for reporting this vulnerability.


Nice findings :) (y)


What you get from RSC Bux - Main Benefits :

Earn from home
Garneted ads daily
Detailed statistics
forum permissions
Upgrade plans
Instant Payment
Reach millions of clients
Easy management
Demographic filter
Affordable rates
Anti-cheat protection
Detailed statistics

the rsc bux
perfect money
get Free Money Online


This one takes a bit of timing, and a lot of patience: as soon as you see the signs, get your child to the potty/toilet as quickly as you can (you might need to lift them up and run!), and put them on the toilet seat. Sit with him reading or with an iPad or whatever until he goes. Huge applause and reward. Repeat until the connection is made. I have found some good pottytrainingapp from searching google. You may try this apps for become a special potty trainer for your sons. Thanks.


Post a Comment