Member-only story
Business Logic Flaw in a Rating System and Earned €150
Bug bounty hunting is often about the little details a forgotten header, a missing validation, or in this case a rating system without limits.
In this post, I’ll share how I discovered a simple but impactful business logic vulnerability in a media website’s rating system. While the vulnerability wasn’t critical in the traditional sense (no RCE, no data leaks), it still had real-world implications for content manipulation — and earned me a €150 bounty.
During one of my regular reconnaissance sessions, I focused on a invited — private bounty program. I noticed the site had an active and visible comment section under each article, and users could upvote or downvote comments.
What caught my eye was the UI interaction: when I clicked on the “upvote” button, the count incremented immediately without a page reload. That meant JavaScript was involved and most likely, a background API call.
Opening my browser’s developer tools, I watched the network requests as I clicked the vote button. As expected, it sent a POST request to a GraphQL endpoint with a mutation that looked something like this:
mutation {
updateCommentRatingPositive(commentId: "12345")
}This request increased the vote count by one for the specified comment.
