{"id":271131,"date":"2018-08-13T11:01:07","date_gmt":"2018-08-13T09:01:07","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=271131"},"modified":"2018-08-13T11:03:24","modified_gmt":"2018-08-13T09:03:24","slug":"security-flaw-reported-on-gauteng-school-applications-website","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/271131-security-flaw-reported-on-gauteng-school-applications-website.html","title":{"rendered":"Security flaw reported on Gauteng school applications website"},"content":{"rendered":"<p>MyBroadband was recently informed of a potential security flaw on the Gauteng Department of Education&#8217;s\u00a0<strong><a href=\"https:\/\/www.gdeadmissions.gov.za\/\" target=\"_blank\" rel=\"noopener\">admissions portal<\/a><\/strong>.<\/p>\n<p>The website facilitates online applications for admission of learner to public schools for grades 1-8.<\/p>\n<p>Through the website, parents or guardians can apply online for their child to be admitted into selected public schools in Gauteng.<\/p>\n<p>Once they have completed the application form, parents can then monitor their application through the portal after logging in with their user name and password.<\/p>\n<p>These credentials are provided to users once they register an account and submit an application.<\/p>\n<h3 class=\"my-4\">Potential security problem<\/h3>\n<p>A potential security issue was reported to MyBroadband by a concerned user who used the admissions portal.<\/p>\n<p>To monitor their applications, users are provided with a URL directing them to a page on the website &#8211; from which they can monitor their application after logging in.<\/p>\n<p>After logging in and viewing their application, however, the user reported that they could change the application number at the end of the URL to view other applicants&#8217; details.<\/p>\n<p>By changing the application number at the end of the URL in their web browser, the user could see the following details of other applicants&#8221;<\/p>\n<ul>\n<li>School name<\/li>\n<li>Learner&#8217;s full name<\/li>\n<li>Parent\/Guardian&#8217;s full name<\/li>\n<li>Learner&#8217;s ID number<\/li>\n<li>Parent\/Guardian&#8217;s ID number<\/li>\n<li>Distance from school in km<\/li>\n<\/ul>\n<p>This potential security issue could be due to a failure to properly secure each application against access by other registered users, making all applications accessible to any applicant logged in to the system.<\/p>\n<h3 class=\"my-4\">Gauteng Department of Education<\/h3>\n<p>MyBroadband contacted the Gauteng Department of Education, alerting them to the potential issue and asking for feedback on the matter.<\/p>\n<p>The department confirmed it had received notification of the problem. Despite multiple follow-ups, however, it did not provide feedback.<\/p>\n<h3 class=\"my-4\">Now read:\u00a0<a href=\"https:\/\/mybroadband.co.za\/news\/security\/270937-new-scam-email-targets-absa-and-mweb-clients.html\" rel=\"bookmark\">New scam email targets Absa and MWEB clients<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>MyBroadband was recently informed of a potential security flaw on the department&#8217;s admissions portal.<\/p>\n","protected":false},"author":341028,"featured_media":142006,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[35715,35,52961,15511],"class_list":["post-271131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-gauteng-department-of-education","tag-headline","tag-public-schools","tag-security-flaw"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/271131"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341028"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=271131"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/271131\/revisions"}],"predecessor-version":[{"id":271755,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/271131\/revisions\/271755"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/142006"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=271131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=271131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=271131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}