1

I am working in QA field and we have a project about a famous booking website.

I have discovered that if I create an account with the same name, surname and date of birth of an already registered account, I am able to see the personal page of the latter. This means that I can see his phone number, address and bookings.

Moreover, if I modify these fields also the settings of the original account will be modified. This means that I can also block another account by registering mine on a different market, because this will change its Country field and prevents him from logging from its market.

I have pointed out this behavior but I only got a "works as intended" answer.

Is this a severe security issue or it is just me? Thank you.

Improve this question
4
  • 1
    You should report the site to your local data protection office!
    – Lithilion
    Commented Feb 4, 2019 at 11:25
  • Are the details of the account you created get displayed (in some way) alongside with the target account details or only the latter being displayed as yours ?
    – elsadek
    Commented Feb 4, 2019 at 12:48
  • Only the latter and it is displayed as mine. If I edit something I also override the info in the target account.
    – Francesco Villano
    Commented Feb 4, 2019 at 13:00
  • Data protection requirements vary greatly by jurisdiction - what the legal obligations / exposure are depends on where the data is held and where it is accessed. You forget to tell us about these. (but IMHO this sucks everywhere)
    – symcbean
    Commented Feb 4, 2019 at 14:52

1 Answer 1

Reset to default
1

Given that name, surname and birth date are easily to obtain information for a single person or even in bulk there is (based on your description) an obvious risk that personal information can be viewed and changed (which might result in charges to this person) and also for en-masse denial of service.

Given that this "works as intended" the ones who designed this system either did not understand these risks or they've knowingly accepted the risk in favor of improved usability of this site - which can be a valid decision for this specific use case (although it sounds unlikely based on what you write). If I understand you correctly you are working in QA of this site. In this case it should hopefully be possible to discuss the design decisions with the developers and software architects to find out if they are aware of the risks and consider these acceptable.

Improve this answer
1
  • I think you are right about talking first with the developers but it seems that they just want to hide this issue. I already tried the "official" way by opening a Jira ticket about that and they rejected it. Maybe it's time to talk with the team manager directly.
    – Francesco Villano
    Commented Feb 4, 2019 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .