I am sorry for my lack of knowledge in this matter.
My university (basically an international university in the UK that has students from different countries) has a website which requires the students to login before they can access their examination results. These results also include their Name and Address.
But by inspecting the network transaction, I found out that it went to a page that directly takes student registration number in the URL and displays the examination result related to that. This page can be accessed without logging in to the student account and without any hassle, it gave me the examination result that exposed the student name and address. I tried multiple registration numbers similar to mine and all were processed easily.
Another problem is that these registration numbers are in fixed length, only contain numbers and are in ascending order. So for example if a valid registration number is 000001 then the next one would be 000002 and so on.
So in my opinion an attacker can easily create an automated program that could generate these registration numbers, randomly or in order, and get the names and addresses of hundreds of students.
My questions are:
- Is it universally approved practice for universities to expose the names and addresses of students?
- Is it universally approved practice for universities that strong security related to name and address is not important?
- Is it a severe attack and do I have to report it to them? Or can it simply be ignored?
I received the reply from the university and they have now fixed it. Thanks to all of you.