Moonpig.com Vulnerability – Exposes customer data
1–10 of 124 posts
Re: Moonpig.com Vulnerability – Exposes customer data
#2Wow. This is actually still wide open. This is really bad.
Fun fact - you don't even have to send the basic aut header - it'll respond just fine without it.
Re: Moonpig.com Vulnerability – Exposes customer data
#3I'm sure the (outsourced) dev team will have a bad day tomorrow. This is just unacceptable. According to the blog post he first made contact in 2013! Bugs happen, but this is just bad design.
Re: Moonpig.com Vulnerability – Exposes customer data
#4I'm sure the (outsourced) dev team will have a bad day tomorrow. This is just unacceptable. According to the blog post he first made contact in 2013! Bugs happen, but this is just bad design.
[deleted]
Re: Moonpig.com Vulnerability – Exposes customer data
#5To anyone thinking of enumerating the customer IDs to play with this, be very careful as it's illegal in the USA. That is exactly what weev was arrested and convicted for.
Re: Moonpig.com Vulnerability – Exposes customer data
#6Surely this is bad enough to warrant criminal prosecution? Not sure if that's even possible in the UK but it ought to be...Shameful to have sat on that for over a year. Shameful.
Re: Moonpig.com Vulnerability – Exposes customer data
#7Lots of users on Twitter saying to delete your account, but is there any proof that this will exclude your account from the API?
Re: Moonpig.com Vulnerability – Exposes customer data
#8Lots of users on Twitter saying to delete your account, but is there any proof that this will exclude your account from the API?
Odds on it adds a "deleted" flag to your account record and nothing more...
Re: Moonpig.com Vulnerability – Exposes customer data
#9I am a former customer of theirs (in the UK) and just contacted CS about this. I'm also looking into contacting the Information Commissioner's Office as this issue is still open and my personal information (and that of the people I send cards to) is still available to anyone who may want it.
I'm pretty sure them ignoring this for a year is illegal as it involves personal information which their privacy policy didn't authorise them to publish. However I'll leave it to the ICO to make that determination.
Re: Moonpig.com Vulnerability – Exposes customer data
#10Surely this is bad enough to warrant criminal prosecution? Not sure if that's even possible in the UK but it ought to be...Shameful to have sat on that for over a year. Shameful.
If this were the USA it would certainly be bad enough to warrant prosecution of the researcher. I am not familiar with laws in the UK, however. Keep in mind the similarities between this research and weev's research.
This type of blatant insecurity definitely should be punished and I wish more policy makers both cared, and made the effort to understand the terminology behind phrases like "No authentication", "Plaintext", Etc.