# Password Reset - query param overrides postdata

Password reset form read newpassword from GET query params, overriding POST values, letting an attacker fix a victim's new password to a known value via a crafted link.

- Payout: $1,500
- Severity: high
- Program: Snapchat
- Credited: reecer
- Disclosed: 2015-12-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/96636
- Library page: https://bugbountylibrary.com/r/h1%3A96636
- Tags: domain:web impact:ato kind:bounty platform:hackerone sev:high technique:param-pollution vuln:access-control vuln:business-logic

**Target:** change_password endpoint
**Root cause:** Server could not distinguish GET and POST parameters and preferred GET values, so query-string newpassword/newpassword2 overrode the form's POST values.
**Steps:**
1. Craft URL `https://accounts.snapchat.com/accounts/change_password?newpassword={attackerPass}&newpassword2={attackerPass}`
2. Send link to victim whose username is known
3. Victim enters current password and solves CAPTCHA on the form
4. Server applies GET newpassword over POST value, setting password to attacker-known value
**How found:** Researcher noticed the change_password endpoint accepted newpassword/newpassword2 as query parameters and that they took precedence over form POST values.
**Exploitation:** Social-engineer victim into visiting the crafted URL and completing the change-password form (current password + CAPTCHA); the GET params override the submitted new password, so the attacker learns the resulting credential and takes over the account.
**Insight:** On password/credential forms, test whether the same field names supplied as GET query params override the POST body; parameter-source precedence bugs let a crafted link silently fix the new secret.