Impact Meter Services, a water and electricity billing provider that is widely used in the Tshwane municipal area, unintentionally let its clients view one another\u2019s invoices on its website.<\/p>\n
This kind of security flaw has occurred regularly in the online portals of various organisations, including City of Joburg and Vodacom.<\/p>\n
A document containing personal information such as an invoice is requested from a website using a sequential numeric identifier, making it easy to get someone else\u2019s document from the site.<\/p>\n
For example, an Impact customer who\u00a0is logged into the site might retrieve their latest invoice with the following URL: http:\/\/amps.co.za\/Secure\/ViewPdf.aspx?id=42000<\/p>\n
While logged in, they can change the URL to id=1, id=2, or id=9001 to retrieve someone else\u2019s invoice.<\/p>\n
Fortunately these invoices contained minimal personal information: full names, address of the house being billed for water and electricity consumption, billing address (if different), and amounts owed.<\/p>\n
Impact Meters was contacted about the flaw and a developer responded in under 24 hours to say they were working on a fix.<\/p>\n
Just over a week later, the company responded to say that the security flaw had been patched, and thanked the person who reported the issue.<\/p>\n
Critical security bug gets SA sites, hosts scrambling<\/strong><\/a><\/p>\n E-toll website security flaws galore<\/strong><\/a><\/p>\n E-toll security hole: don\u2019t shoot the messenger<\/strong><\/a><\/p>\n