gistfile1.txt

**An Attacker can Delete any Victims account with your Helpdesk**


Here Attacker can make a request to delete victims account through this form Behalf of Victim 

By this any one can delete victims account by using your contact us (Helpdesk)

IMPACT:

Account Deletion of Any Account 


STEPS:
****
    Go to  https://ask.stashinvest.com/contact/ and Go to Ask Question and Go to Contact and Now Submit your Question as Delete my account with the Victim mail

	It will take atleast 15 day or less to remove the account


****
Proof Of Concept:


Recommendation fix:

Critical actions like close account should be verify by sending PIN code to user email and asks him to reply back the code again.

Thank You

Best regards,
d4r3_d3v1l_