Talkpal — vulnerability disclosure

Full report disclosure of an unpatched vulnerability in Talkpal.

INTRO

I was checking out how the AI language teacher — Talkpal works. By the way, I also checked for any simple bugs related to bank card handling.

The trick will allow you to get a free membership for a year (probably if they do not patch for another, too), while it normally costs $12 per month.

Source

I reported this to the vendor, and since there has been no response for 90 days, I am disclosing the report to the public.

PROOF OF CONCEPT

The bug allows anyone to get a free yearly subscription without paying.

• To start a trial, the user has to issue valid card details (but no ghost transaction checks the card, which is a minor issue here).
• During the trial period, the user can freeze the card or not have enough funds on the account to pay, or sometimes the bank can automatically block the automatic transaction forced by the app’s subscription system that was earlier not authorized by a ghost transaction.
• After the trial ends, an automatic…