# [www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s)

Zomato iOS payment API trusted client-supplied plan_id and amount, letting an attacker set plan_id=147 and amount=0 to get free Gold membership.

- Payout: hidden
- Severity: medium
- Program: Eternal
- Found by: pasw
- Disclosed: 2019-03-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/511044
- Library page: https://bugbountylibrary.com/r/h1%3A511044
- Tags: area:mobile domain:api domain:mobile impact:funds-loss impact:integrity kind:bounty platform:hackerone sev:medium tech:ios technique:fuzzing vuln:business-logic

**Target:** iOS app payment/checkout API endpoint
**Root cause:** The checkout API accepts client-controlled plan_id and amount without server-side validation, and multiple plans (including a zero-cost plan_id 147) remain valid simultaneously.
**Steps:**
1. Login to the Zomato iOS app and select Zomato Gold from home screen.
2. Pick any Gold pack and a payment method.
3. Intercept the checkout request in Burp: `POST ...&amount=1050&city_id=4&client_id=zomato_ios_v2&...&plan_id=40`.
4. Enumerate plan_id values with Burp Intruder; find plan_id 147 has membership cost 0.
5. Replay request with `amount=0` and `plan_id=147`.
6. Response: `{"response":{"status":"success","message":"Transaction Approved Without Sending to Gateway"` — Gold membership granted.
**How found:** Noticed the API accepted plan_id and amount as client parameters, then used Burp Intruder to enumerate plan_ids and discovered plan_id 147 had zero cost.
**Exploitation:** Attacker tampers the intercepted checkout request, setting plan_id=147 and amount=0, bypassing the payment gateway entirely to obtain a free month of Gold. Then creates many fake accounts, shares a referral code, and each free referral extends membership by another month.
**Escalation:** Referral program abuse: unlimited fake accounts each purchasing free Gold via the referral code extend the attacker's membership by one month per referral.
**Insight:** When a checkout API takes both a plan_id and an amount from the client, enumerate plan_ids and look for legacy/zero-cost plans still active; also test whether amount is validated against the plan server-side.