{"id":"98f031b4-9ed8-48b9-b95d-e462bccc5238","engagementId":"dcdd1e86-853a-4adc-9c67-b690b1ba3256","data":{"brief":{"id":"f16e49cb-c27e-4b8a-924c-ead851c206bc","name":"eMAG Vulnerability Disclosure Engagement","tagline":"We improve our clients' lives by saving them time and money.","description":"\u003cp\u003eWe have become the market leader in e-commerce by going through a fast-paced growth and we are determined to follow this path. What brought us here is our will for continuous evolution and actual results. \u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will be using the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be given to the researcher - along with the opportunity to appeal, and make a case for a higher priority..\u003c/em\u003e\u003c/p\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of eMAG not listed in the targets section is out of scope. This includes any/all subdomains not listed above.  IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to eMAG, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":"\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eNo payment or promotional codes will be provided for testing purposes.\u003c/li\u003e\n\u003cli\u003ePlease refrain from testing contact forms or inputs that would result in a large amount of spam.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eThere are some things we explicitly ask you not to do:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eWhen experimenting, please only attack test accounts you control. A PoC unnecessarily involving accounts of other end users or eMag's employees may be disqualified.\u003c/li\u003e\n\u003cli\u003eAutomated vulnerability scans are strictly prohibited.\u003c/li\u003e\n\u003cli\u003eIn any way, do not attack our customers/end users, or engage in the trade of stolen user credentials.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eThe following kinds of findings are specifically out of scope for this program:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eOut of date software versions \u003c/li\u003e\n\u003cli\u003eVulnerabilities that are limited to unsupported browsers or operating systems- Password policies not enforced on user accounts \u003c/li\u003e\n\u003cli\u003evulnerabilities in third-party software. Please reach out to the company responsible for the code to have the issues fixed. We may contact the upstream provider, depending on the impact of the vulnerability.\u003c/li\u003e\n\u003cli\u003eCORS issues without a working PoC \u003c/li\u003e\n\u003cli\u003eLogin or Forgot Password page brute force and account lockout not enforced \u003c/li\u003e\n\u003cli\u003eCSRF issues that have no security impact \u003c/li\u003e\n\u003cli\u003eTLS/SSL Issues, bad cipher suite, expired certificates, etc. \u003c/li\u003e\n\u003cli\u003eNon-sensitive exposed API keys (Google Maps, etc.). \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eHAPPY HUNTING!!\u003c/h2\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please reach out to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/home\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e. before going any further.\u003c/em\u003e\u003c/p\u003e"},"scope":[{"id":"c01412bf-c0a3-4acc-8c04-730a1984bce4","name":"eMAG In scope","targets":[{"id":"fb6f7233-a38b-4480-a882-8616c3c667e6","uri":"https://www.emag.bg/","name":"*.emag.bg","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"06a0329c-a234-4ae5-87ec-37954ca90af4","sortOrder":0},"sortOrder":0,"tags":[{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"fb6f7233-a38b-4480-a882-8616c3c667e6"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fb6f7233-a38b-4480-a882-8616c3c667e6"},{"id":"ce8ff3cd-4d54-4404-8321-6351781551a3","name":"Vue.js","targetId":"fb6f7233-a38b-4480-a882-8616c3c667e6"}],"recentChangeFlags":null},{"id":"75fb5209-9466-49bc-8757-d17cdbd6679a","uri":"https://emag.ro/","name":"*.emag.ro","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e34ebae7-3a83-42dd-a634-f93c6420c709","sortOrder":1},"sortOrder":1,"tags":[{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"75fb5209-9466-49bc-8757-d17cdbd6679a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"75fb5209-9466-49bc-8757-d17cdbd6679a"},{"id":"ce8ff3cd-4d54-4404-8321-6351781551a3","name":"Vue.js","targetId":"75fb5209-9466-49bc-8757-d17cdbd6679a"}],"recentChangeFlags":null},{"id":"8d5bfe5b-768b-4468-99d8-cfc15305ffc1","uri":"https://emag.hu/","name":"*.emag.hu","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"360a5c45-0f62-4ce1-8c39-a0aebadcdf45","sortOrder":2},"sortOrder":2,"tags":[{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"8d5bfe5b-768b-4468-99d8-cfc15305ffc1"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8d5bfe5b-768b-4468-99d8-cfc15305ffc1"},{"id":"ce8ff3cd-4d54-4404-8321-6351781551a3","name":"Vue.js","targetId":"8d5bfe5b-768b-4468-99d8-cfc15305ffc1"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"c3ea8168-7886-4081-bda8-ca0b2a540f6c","name":"Sameday","targets":[{"id":"d1f4d74d-66e4-48d0-acfb-b394a317f8f2","uri":"","name":"*.sameday.bg","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"69885efb-b0e7-489b-b8ed-c78b5ed12259","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"bd1c2eb7-1ae0-45ef-b8ef-eaeda2b98227","uri":"","name":"*.sameday.hu","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2b5be20a-d69a-42f7-a3e9-e50a5c255f56","sortOrder":1},"sortOrder":1,"tags":null,"recentChangeFlags":null},{"id":"7d0e8e58-2d0a-4db0-93de-ea686eba657d","uri":"","name":"*.sameday.ro","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a2c2f1a4-ed72-4e51-a279-19d7c4241881","sortOrder":2},"sortOrder":2,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"dcdd1e86-853a-4adc-9c67-b690b1ba3256","code":"emag-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"2dcdbfe0-13ec-4e75-b834-db85d9cb7cbc","startsAt":"2024-05-07T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/edaa/63bd/52a6a945/3abd96508d5a622ed801d0132e68273e_emag.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-05-07T18:00:00.051Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/emag-vdp-pro","changelogs":"/engagements/emag-vdp-pro/changelog","submissions":null,"announcements":"/engagements/emag-vdp-pro/announcements","hallOfFame":"/engagements/emag-vdp-pro/hall_of_fames","crowdstream":"/engagements/emag-vdp-pro/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/emag-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=emag-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/emag-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/emag-vdp-pro/changelog","publishedAt":"2025-03-04T11:03:44.530Z","engagementChangelogUrl":"/engagements/emag-vdp-pro/changelog/98f031b4-9ed8-48b9-b95d-e462bccc5238","createUserFeedbacksUrl":"/engagements/emag-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/emag-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}