Security flaw reported on Gauteng school applications website

[Newsfeed]

Security flaw reported on Gauteng school applications website

MyBroadband was recently informed of a potential security flaw on the Gauteng Department of Education’s admissions portal.

The website facilitates online applications for admission of learner to public schools for grades 1-8.

 

[Wall]

is it fixed?

 

[ActivateD]

So no penetration test was done to the website before being pushed to production? I wonder what other OWASP top 10 vulnerabilities exist on the website

 

[lived666]

LOL wait until mybb are accused of hacking now

 

[McGuywer]

This has happened way to many times before....
Same development company?
Didn't Joburg or Pretoria have the same issue?

 

[Ho3n3r]

For a moment there, I thought I landed on the Gautrain website.

 

[Batista]

gDeadMissions.co.za lol

 

[quovadis]

So no penetration test was done to the website before being pushed to production? I wonder what other OWASP top 10 vulnerabilities exist on the website

A pen test will generally not pick up *****ty coding

 

[ActivateD]

A pen test will generally not pick up *****ty coding

True true but really URL tampering is something penetration test would pick up easily at the least make sure the OWASP top 10 vulnerabilities are covered.

 

[^^vampire^^]

This has happened way to many times before....
Same development company?
Didn't Joburg or Pretoria have the same issue?

Cadres kids who just finished uni (3 year degree in 8 years) and then building websites when they have no clue.

 

[Fuzzbox]

What a useless website. Many mistakes
Not very responsive.
Useless for mobile.

 

[ISP cash cow]

Isn't this the exact same issue that the City of Joburg had with the municipality accounts a couple of years ago, which one of the MYBB members found and tried to warn the government of the issue and then got all hot headed claiming he was hacking?

You would of thought the government had learned its lesson in creating websites with flaws.

 

[Sl8er]

You would of thought the government had learned its lesson in creating websites with flaws.

:crylaugh:

 

[puppy]

https://www.ssllabs.com/ssltest/analyze.html?d=www.gdeadmissions.gov.za&hideResults=on

This server is vulnerable to the Return Of Bleichenbacher's Oracle Threat (ROBOT) vulnerability. Grade set to F.
This server does not support Authenticated encryption (AEAD) cipher suites. Grade capped to B.

Go security!

Only thing they seem to have correct is the cert lol

 

[kianm]

Hehe this looks like a basic failure

 

[manMountain]

Is their a database of personal information? If there is there should be security audits. If due process is not followed and there is a leak of personal information the government is opening itself for a massive lawsuit, especially if people are coerced into having to add their information.

 

[LCBXX]

The amount of .gov.za sites that fail basic vulnerability assessments is staggering.