Sale of IDOR vulnerability in a Saudi courier company

For informational purposes only

Country: Saudi Arabia 🇸🇦 Sector: logistics / courier delivery Annual revenue: $1 billion

According to the seller's description, the vulnerability allows downloading a PDF file for each waybill number. Each such document, according to the seller, contains data related to a specific delivery: the recipient's phone number, name, full address, country and city, email, as well as the sender's data - address, phone number, company, country and city. Additionally, the documents may contain information about the number of items, weight, and parameters of the shipment. The potential scale is up to several million records.