# 6k$ Worth Account Takeover via IDOR in Starbucks Singapore

IDOR in a Starbucks Singapore staging endpoint let an attacker set an arbitrary email, then reuse the PHPSESSID on production to reset the victim's password and take over the account.

- Payout: $6,000
- Severity: critical
- Program: Starbucks
- Credited: Kamil Onur Özkaleli
- Disclosed: 2020-10-07
- Write-up quality: 8/10
- Original: http://www.kamilonurozkaleli.com/posts/starbucks-singapore-account-takeover/
- Library page: https://bugbountylibrary.com/r/blog%3Akamilonurozkaleli-com-posts-starbucks-singapore-account-takeover
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:critical tech:php technique:chained technique:recon vuln:access-control vuln:account-takeover vuln:idor

**Target:** card.starbucks.com.sg web app and its staging environments on a third-party host
**Root cause:** A staging endpoint accepted an arbitrary email parameter and associated the session with that account without verifying ownership, and the staging PHPSESSID was accepted by the production app sharing the same session store.
**Steps:**
1. Recon: find example.com/starbucks mirroring card.starbucks.com.sg login; confirm same auth by logging in with a production account.
2. Find staging-only endpoint accepting `email=hacker@hacker.com`; send victim email to leak partial profile info.
3. Password change fails due to invalid CSRF token on staging.
4. Copy PHPSESSID from example.com/starbucks to card.starbucks.com.sg; session is valid in production.
5. Request password change on production with valid CSRF token to take over victim account.
6. Chain: create dummy account with victim email at example.com/starbucks3, associate it via the endpoint at example.com/starbucks2, copy that PHPSESSID to production.
**How found:** Noticed a page loading content from a third-party site, found a Starbucks login directory on it, hypothesized it was a staging environment, and confirmed shared authentication by logging in with a freshly created production account.
**Exploitation:** Attacker knows victim email, submits it to the staging IDOR endpoint to bind the session to the victim, then transplants the PHPSESSID cookie to the production domain where CSRF tokens are valid, allowing a password reset and full account takeover; stored credits can be spent via the Starbucks mobile app.
**Escalation:** Chained three staging environments (starbucks3 to create test user, starbucks2 to associate session, production to take over) to bypass the test-users table limitation, earning a 1.5x bounty multiplier.
**Insight:** When a third-party host mirrors a production login, test whether sessions are shared across environments: a cookie minted on staging may be trusted by production, turning a staging-only IDOR into a production takeover.