بِسْمِ اللَّهِ الرَّحْمَـٰنِ الرَّحِيمِ
اللَّهُمَّ صَلِّ وَسَلِّم وَبَارِكْ عَلَى نَبِيِّنَا مُحَمَّد
Hello Hunters 👋,
During one of my research sessions, I stumbled upon a very interesting client-side flaw on Private programm . What started as a quick test on a free account ended up unlocking premium-only features like Download and Share — just by flipping a flag in Burp Suite!
Let’s dive in 🚀
Summary
I found a vulnerability that allows free users to unlock premium-only features (Download, Share to Facebook, Share to Twitter) by simply tampering with a boolean flag (clientMatch) on the client side.
The backend failed to validate the subscription level, relying entirely on client input to decide whether the features should be enabled or not.
Discovery
I signed up for a free account and started exploring the platform.
After uploading an image and right-clicking on it, I noticed the Download and Share options were present but locked — reserved for premium users.
That immediately caught my eye 👀.
“Are these restrictions just UI-based, or does the server actually enforce them?”
So, I fired up Burp Suite to test it out.
Exploiting the Flaw
Using Burp’s Match & Replace feature:
-
Match:
false -
Replace:
true
I reloaded the page, and to my surprise…
💥 The Download and Share buttons lit up and became fully functional.
No subscription. No upgrade. Just one replaced word.
From there, I was able to:
-
Download premium-edited images (revenue bypass ✅)
-
Share them directly to Facebook and Twitter (entitlement bypass ✅)
The server completely trusted the manipulated flag and never checked whether my account was actually premium.
The Root Cause
The backend relied on a client-side flag (clientMatch) to determine entitlement instead of validating user privileges server-side.
This is a classic Improper Access Control / Business Logic flaw where the server assumes the client is “honest.” Spoiler: it never is.
Impact
-
Revenue Loss: Free users can download premium-only content without paying.
-
License Bypass: Paid-only content can be exfiltrated.
-
Unauthorized Feature Use: Free users can share to Facebook/Twitter, abusing integrations.
CVSS Score
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N → 5.3 (Medium)
Conclusion
This vulnerability was simple but impactful. It highlights once again:
👉 Never trust the client.
👉 Authorization belongs on the server.
Alhamdulillah, it was a fun find and an easy win.
Until next time, happy hunting! 🐞
