City of Joburg - security issue - everyone can see all customers statements

[MagicDude4Eva]

Since COJ call-centre is unwilling to take in this report, perhaps RPM/MyBB can assist

- Log into eServices (http://eservices.joburg.org.za/)
- Click on "Account by Email" on the left
- On the next screen, put in your account number and PIN (is on any of your COJ statements)
- Click Continue
- Click on "Get Statements"
- Click on "Click to View" statement - this will open your statement
- The URL will be something like this: http://cojestatements.co.za:8080/cojpdfweb/getPDF?documentID=########&download=false
- Increment the number and you will be able to display other customers statements

BTW: Just tested and you can view any customers statement without logging in - http://cojestatements.co.za:8080/cojpdfweb/getPDF?documentID=11800132####&download=false

Change the #### to any four digit number or change the whole number and you will just be able to data mine invoices

The above information can be used for any criminal activities such as:
(1) Use the statement for RICA/FICA or wherever you require a municipality statement
(2) Use the customers account-number and PIN to access his details on COJ (or register if not registered)
(3) Use it for social engineering or other criminal activities (you will find out the value of the house, electricity consumption, money spent etc)
(4) Perhaps go as far as have the cheek and phone CoJ to request a refund and cancel the account if the customer is in credit

 

[Ancalagon]

Doesnt seem to work for me - I get a blank statement. But then I didnt authenticate by logging in first.

My guess - once you have authenticated by logging in, you are authorized to view any statement.

 

[Aquila ka Hecate]

This is sickening. I've just viewed a selection of total strangers' municipal accounts.

 

[Bizkit87]

Doesnt seem to work for me - I get a blank statement. But then I didnt authenticate by logging in first.

My guess - once you have authenticated by logging in, you are authorized to view any statement.

I didn't even have to log in, just clicking that link and changing the numbers show me all the invoices i can guess.

 

[Cool E]

Doesnt seem to work for me - I get a blank statement. But then I didnt authenticate by logging in first.

My guess - once you have authenticated by logging in, you are authorized to view any statement.

Change the #### to any four digit number on the url.

It works.

Damm not safe at all

 

[karnuffel]

Lol i tested it and got a dude 27k in arrears...

 

[PhireSide]

Lol i tested it and got a dude 27k in arrears...

I found about 4 with R13K+ each, and a few with null balance but also null due by them.

/stops snooping around online

 

[The_Unbeliever]

Try to find the mayor's own account, and post it online.

Guaranteed to have this issue resolved quickly.

 

[LazyLion]

Try to find the mayor's own account, and post it online.

Guaranteed to have this issue resolved quickly.

Or any celebrity really

 

[Trixanno]

I guess finding a proof of residence for RICA/FICA wont be difficult anymore.
/end sarcasm

 

[Budza]

Let's see an article.

Guesses on time it'll take them to fix this?

 

[MagicDude4Eva]

Honestly tried to report it to COJ, but call-centre could not assist and sending them an email will also not result in anything. Perhaps anyone on here has an IT contact to address this pls...

 

[Sinbad]

Have advised my local councillors...

 

[blunomore]

Since COJ call-centre is unwilling to take in this report, perhaps RPM/MyBB can assist

- Log into eServices (http://eservices.joburg.org.za/)
- Click on "Account by Email" on the left
- On the next screen, put in your account number and PIN (is on any of your COJ statements)
- Click Continue
- Click on "Get Statements"
- Click on "Click to View" statement - this will open your statement
- The URL will be something like this: http://cojestatements.co.za:8080/cojpdfweb/getPDF?documentID=########&download=false
- Increment the number and you will be able to display other customers statements

BTW: Just tested and you can view any customers statement without logging in - http://cojestatements.co.za:8080/cojpdfweb/getPDF?documentID=11800132####&download=false

Change the #### to any four digit number or change the whole number and you will just be able to data mine invoices

Inform a DA councillor.

 

[medicnick83]

I also tested a random number and yeah... that is so not lekker.

Very dodgy security!

 

[Inertia]

Can someone get hold of Parks Tau's statement? I can then tweet to Helen Zille and the rest of the DA team

 

[Sinbad]

I found one 140k in arrears.

 

[Beachless]

What can you do with the account number and pin code?
You can see it on the bill.

 

[Rickster]

Or any celebrity really

We have those in SA?

 

[supersunbird]

What can you do with the account number and pin code?
You can see it on the bill.

You can do lots of scamming with the info, targetted phissing attacks, produce fake ID books and proof of residence to match.