Minor Payload Change Crashes Entire Production Server – Should I Report This?
I recently received a private invitation to hack on a program on H1. While testing an endpoint, I made a minor change to the JSON payload—specifically, modifying a boolean value to a string.
{
"is_admin": true
}
changed to something like:
{
"is_admin": "xyz"
}
Sending this payload caused the entire production server to go down for about two minutes—not just for me, but for all users. I just repeated the test once more just to confirm that this minor change indeed crashes the server, and it does.
I’m now unsure how to proceed with reporting this. Should I report this, or should I just ignore? The program classifies DoS as OOS. Would this be classified as a DoS issue, improper input validation, or something else? Would appreciate insights from other hackers, program managers, or triagers on how to handle this situation properly. Thanks!