# Unauthorized update of merchants' information via /php/merchant_details.php

Unauthenticated POST to /php/merchant_details.php with action=update-merchant let an attacker modify any merchant's email, phone, bank account and other fields, enabling merchant takeover.

- Payout: hidden
- Severity: high
- Program: Eternal
- Found by: adibou
- Disclosed: 2017-09-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/255651
- Library page: https://bugbountylibrary.com/r/h1%3A255651
- Tags: area:web domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:php vuln:access-control vuln:business-logic vuln:idor

**Target:** PHP endpoint /php/merchant_details.php on www.zomato.com
**Root cause:** The merchant_details.php endpoint processes an action=update-merchant request and applies field updates keyed by merchant_id without verifying the caller is authenticated or authorized to edit that merchant.
**Steps:**
1. Identify endpoint `https://www.zomato.com/php/merchant_details.php`
2. Send POST with body `action=update-merchant&merchant_id=95292&type=1&email=update@hotmail.fr&contact=update@hotmail.fr&name=update`
3. Observe merchant record fields change; repeat with `address, pincode, city, email, phone tan_number, bank account name, company_id, payu_id, contact, restaurants`
**How found:** Discovered the exposed PHP file and tested adding an action=update-merchant POST body; prior report #255648 (merchant creation) provided a test merchant to demonstrate the update in a realistic scenario.
**Exploitation:** Attacker enumerates/guesses merchant_id values and POSTs update-merchant to overwrite contact email and bank account fields of arbitrary merchants; changing the bound email could redirect confidential mail and enable merchant account takeover.
**Escalation:** Changing the merchant's email to an attacker-controlled address could allow binding to the attacker's user account, leading to merchant takeover.
**Insight:** Legacy /php/*.php endpoints on large sites often expose action-dispatch handlers that trust a client-supplied object id (merchant_id) with no session check; fuzz action= values on discovered PHP files and try updating records you created via other bugs to prove impact.