Full disclosure: Edupage web and mobile application authorization bypass leaks PII and IBAN codes

Posted by Juraj Kosik on May 17

VULNERABILITY

Both authenticated and publicly accessible anonymous guest accounts on

Edupage portal allow an attacker to capture the complete list of user IDs,

names (students, parents, and teachers), and the associated banking details

(IBAN codes)



Full disclosure report:



VENDOR:

Applied Software Consultants



PRODUCT:

Edupage - https://www.edupage.org/

Web application...