www.tvlic.co.za

[Beachless]

Does anyone feel like doing a story on the www.tvlic.co.za web site?

I went through the process of paying my tv licence online and just before submitting i noticed it did not have my email address so I hit the back button only to be presented with the "Your credit card has been debited in the amount of R 250" message and a reciept complete with reference number.

I then registered online, all they ask to register is your tv licence number and your new password and password confirmation.
This means I can register with anyones licence or guess a licence and register once I find a working one.

This is really a horible site and probably a huge sequrity risk to unregistered clients.

For instance I can guess a licence number, register it and instantly have access to the following details for that person:

Title:
Name:
Surname:
Email Address:

Residential Address
Flat/Office Number :
Flat/Building/Farm/Zone :
Street Number :
Street Name :
Suburb :

Postal Code :
Province :

Postal Address
Address Line 1:
Address Line 2:
Address Line 3:
Address Line 4:
Postal Code : 0
Contact Number 1

So if someone can get them to fix the issues that would be great...

 

[ABCpt]

and when you have my address, you can pay my license as well. Do you want my license number?

 

[Beachless]

and when you have my address, you can pay my license as well. Do you want my license number?

Sure, then I'll steal your identity purchase stuff on credit and sell it off for a nice profit...

 

[guest2013-1]

why the hell would you want to register for someone elses tv license?

 

[Beachless]

why the hell would you want to register for someone elses tv license?

So you can get information on that person to use for illegal means...

The point is they are exposing private details to the world and putting people at risk for ID theft and social engineerd attacks.