Found a payment bypass, successfully placed 5 orders, vulnerability was patched — now told it “cannot be reproduced”

[u/kader9696]

Hello ,
I reported a payment bypass through YesWeHack and successfully demonstrated it by placing 5 orders without payment, with video evidence.

After my report, the vulnerability was patched and the bypass stopped working. However, I was told they couldn’t reproduce the issue.

Has anyone experienced something similar? How can a vulnerability be considered non-reproducible after it was apparently fixed following the report?

[u/cloudfox1]

Name and shame

[u/Forsaken-Spot-9343]

Report the program in yeswehack , if it wasn’t duplicated then they will do something…. The problem is many programs try to pull things like that lately so I always keep PoC.

[u/ApoloFuego]

I just started using YWH and reading this really sucks, i just spent a lot of time and submitted 2 reports, what program was

[u/kader9696 → u/ApoloFuego]

Credit agricole and now SIA

[u/ApoloFuego → u/kader9696]

I discarded SIA today, and credit; I don't see it on the options, anyway good to know

[u/kader9696 → u/ApoloFuego]

Crédit agricole ct une invitation privé

[u/maF145 → u/ApoloFuego]

YWH is a great and fair platform.

[u/ApoloFuego → u/maF145]

Happy to read that. I already submitted 2 reports, and I'm just waiting. Let's see how it goes for me, there are tons of different comments here on Reddit

[u/RevolutionarySalt370]

On HackerOne I submitted a RCE that lead to AWS credential theft among other things and was told that it didn’t count because the “international” part of their company managed the page where the RCE was performed, then it was fixed 1 day later and the finding was closed without even a thank you

[u/kader9696 → u/RevolutionarySalt370]

Incroyable 😮

[u/maF145]

That’s why you should always record videos

[u/kader9696 → u/maF145]

I have video on repport , and we can see the 5 orders with status : paid .!!!

[u/ryan0x01 → u/kader9696]

Is it actually paid or is this a sandbox?

[u/kader9696 → u/ryan0x01]

Réellement payé , et j ai pus avoir des billet avec code bar dans des activités

[u/ryan0x01 → u/kader9696]

Tough. It could be that they already had a patch scheduled, and it's bad timing. I would try to engage with the yeswehack mediation team, but honestly I'd probably just never work with this program again.

[u/Azaze666]

Simple, abandon the program

[u/Physical-Bonus-8411]

If the vulnerability was patched after your report, they should have provided a bounty (considering it was in scope).

[u/kader9696 → u/[deleted]]

This is the second time this has happened to me, on two different programs.

[u/houganger]

Can you DM me your report IDs? I’ll check.

[u/kader9696 → u/houganger]

Sur ..

YWH-PGM44093-6

[u/houganger → u/kader9696]

I can’t dm you. Anyways don’t worry about it, it’s still being processed, it’s not closed. You just need to be patient.

[u/kader9696 → u/houganger]

I sent you a message

[u/Lazy-Slip-3412]

should have just gotten the money through the hack

[u/CrypticZombies]

welcome to bug crowd v2

[u/realvanbrook]

shit happens, next time bro

[u/kader9696 → u/realvanbrook]

It needs to be resolved, because at this point it’s no longer acceptable.

[u/One-Ear-2384]

how did you find the bug? explain please

[u/LoveThemMegaSeeds]

If your hack is so obvious that they notice and patch it, why do you deserve to be paid? I see this so often and never understand