# login to any user's cashier account and full account information disclosure

Cashier iframe login.asp trusted a client-supplied PIN parameter, letting anyone log into any user's cashier account by swapping the account ID and view PII or withdraw funds.

- Payout: hidden
- Severity: critical
- Program: Deriv.com
- Found by: zombiehelp54
- Disclosed: 2015-11-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/98247
- Library page: https://bugbountylibrary.com/r/h1%3A98247
- Tags: area:web domain:web impact:ato impact:funds-loss impact:pii-leak kind:bounty platform:hackerone sev:critical technique:param-pollution vuln:access-control vuln:auth-bypass vuln:idor

**Target:** cashier.binary.com login.asp iframe endpoint
**Root cause:** The cashier login.asp endpoint authenticated users solely by a client-editable PIN (account ID) parameter in the iframe URL, with static Password/Secret values shared across users, so no server-side binding to the session existed.
**Steps:**
1. Create two accounts, log into each in separate browsers (victim and attacker).
2. In the victim account, go to https://www.binary.com/cashier, click Deposit then Continue.
3. In the attacker account, do the same and inspect the `<iframe id="cashiercont">` element.
4. Note the src `https://cashier.binary.com/login.asp?Sportsbook=...&PIN=CR342435&Lang=en&Password=0e552ae717a1d08cb147f132a31676559e3273ef&Secret=1328d47abeda2b672b6424093c4dbc76&Action=DEPOSIT`.
5. Edit the iframe src, replacing the `PIN` value with the victim's account ID.
6. Reload; the iframe now shows the victim's cashier account.
7. Click cashier, then the view link next to customer name to read full name, email, phone.
**How found:** Researcher inspected the cashier iframe element and noticed the account identifier was passed as a plain PIN query parameter alongside static Password/Secret, hypothesizing it was the sole auth factor.
**Exploitation:** Attacker only needs the victim's account ID (PIN). By editing the iframe src PIN parameter while keeping the shared Password/Secret, the cashier backend logs the attacker's browser into the victim's cashier session, exposing PII and enabling withdrawal to the attacker's credit card/Skrill.
**Escalation:** From PII disclosure (phishing) to direct fund theft by withdrawing victim balance to attacker-controlled payment methods.
**Insight:** When a third-party cashier/payment iframe authenticates via URL query params, check whether the account identifier (PIN/account number) is the only per-user value while Password/Secret are constant across sessions — swapping just the identifier often yields full account takeover.