I am working in QA field and we have a project about a famous booking website.

I have discovered that if I create an account with the same name, surname and date of birth of an already registered account, I am able to see the personal page of the latter. This means that I can see his phone number, address and bookings.

Moreover, if I modify these fields also the settings of the original account will be modified. This means that I can also block another account by registering mine on a different market, because this will change its Country field and prevents him from logging from its market.

I have pointed out this behavior but I only got a "works as intended" answer.

Is this a severe security issue or it is just me? Thank you.

  • 1
    You should report the site to your local data protection office! – Lithilion Feb 4 '19 at 11:25
  • Are the details of the account you created get displayed (in some way) alongside with the target account details or only the latter being displayed as yours ? – elsadek Feb 4 '19 at 12:48
  • Only the latter and it is displayed as mine. If I edit something I also override the info in the target account. – Francesco Villano Feb 4 '19 at 13:00
  • Data protection requirements vary greatly by jurisdiction - what the legal obligations / exposure are depends on where the data is held and where it is accessed. You forget to tell us about these. (but IMHO this sucks everywhere) – symcbean Feb 4 '19 at 14:52

Given that name, surname and birth date are easily to obtain information for a single person or even in bulk there is (based on your description) an obvious risk that personal information can be viewed and changed (which might result in charges to this person) and also for en-masse denial of service.

Given that this "works as intended" the ones who designed this system either did not understand these risks or they've knowingly accepted the risk in favor of improved usability of this site - which can be a valid decision for this specific use case (although it sounds unlikely based on what you write). If I understand you correctly you are working in QA of this site. In this case it should hopefully be possible to discuss the design decisions with the developers and software architects to find out if they are aware of the risks and consider these acceptable.

  • I think you are right about talking first with the developers but it seems that they just want to hide this issue. I already tried the "official" way by opening a Jira ticket about that and they rejected it. Maybe it's time to talk with the team manager directly. – Francesco Villano Feb 4 '19 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.