4 ms·

I think that an important point in this vulnerability is that it does not violate the CFAA. From my, albeit limited, understanding of the CFAA, it requires acc

I think that an important point in this vulnerability is that it does not violate the CFAA. From my, albeit limited, understanding of the CFAA, it requires access breach. Imagine this conversation were the user to have discovered a parameter which let the user execute trades on behalf of another user.

PeterisP 10y ago
This vulnerability does allow to execute trades on behalf of another user. For example, a realistic exploit would be to slowly buy up a bunch of a random penny stock; and then post an image link to some forum frequented by users of that software with the order "buy 10000 units of stock_x, okthxbye". The order will be executed by users viewing that forum and will bump up the price as you dump it.