VenomStore logic vuln - PoC

[no.civics]

Subject: VenomStore

Target: venomgermany.com/176.123.10.197 (use Telegram WebApp)
Vector: race condition (fortune wheel)
Status: active

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

API key extracted from frontend. Anon Supabase key.
Gives access to RPC functions and tenant data.

Wheel endpoint:
OPTIONS /functions/v1/retail-mini-app-serve
action=spin_fortune_wheel
bot_id=4f0355aa-9791-4912-9136-917f2658188d

Exploitation:
spin → intercept → drop confirmation → spin again
repeat until desired reward
forward request → reward applied

Replay:
send multiple confirmations simultaneously
no idempotency checks
each request applies independently

Admin UUID:
231c5a03-7418-4c05-bfcf-23952a31fbd0

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

PoC: GitHub - veilcore01/VenomStore-vuln-PoC
Bot: @VenomEuropeBot
Channel: nocivics
Contact: @NOCIVICS_CORE01

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Vendor not notified. Use it while it works.

- nocivics