This question already has an answer here:
- How should I tell school that they are vulnerable when I wasn't given permission to check? [duplicate] 9 answers
- How to report vulnerabilities without being regarded as a hacker? 10 answers
- As a student, how do I safely and responsibly disclose a serious security issue in a school environment? 4 answers
Tl;Dr: I found a serious security threat in my Math department's grading system and I am not sure how to convince them to take it seriously.
I was a bit bored during a lecture so I decided to test my University's Math department grading system. I entered my username, I'll call it "Foo" as well as my password, "Foo123". The system logged in normally. Next, I used "Foo" again as username and "Foo1234" as a password. To my surprise, the system logged in! I was very intrigued at this point and so I tried again with "Foo123wkfjdbwkefbkwdhfbwkfbwkdbw" and again it logged in!
I think that the department saves the password in raw format(instead of a hash) because they clearly use a version of x.contains(real_raw_password). For example, when I posted "Foo123wkfjdbwkefbkwdhfbwkfbwkdbw", I am guessing the back-end did something along the lines of:
if ("Foo123wkfjdbwkefbkwdhfbwkfbwkdbw".contains(ActualPasswordString)):Login() This is a very serious security threat that I think they should address, both because 1) They store the password as raw text and 2) They use a .contains on the actual string sent, when in reality I can send a string with different combinations of passwords and it would return true if any substring returns exists in it.
However, I am not sure how to approach the department and convince them that they need to address it. Any tips on how to approach it especially that it is not a CS department?