About 2 weeks ago, I stumbled across a web application, that can be used by gyms to manage the information about their members. This includes data like the name, billing address, birth date, and medical history. The gym I am visiting (in Europe) is also using this application and so I took a closer look at the application. I didn't dig very deep to avoid legal issues, but these are some of the "problems" I found:
- The login allows infinite tries
- The JSON response from the backend includes information whether the username or password was incorrect
- The user password is stored in the local storage in plain text
- There is an unrestricted file upload for profile pictures
- An old PHP version is used
- There are multiple backends that throw exceptions (this way I could find out which PHP framework they are using)
- Session IDs can be overwritten (Session fixation)
- It seems like there is no input validation. They are using React, so XSS is not as easy but still possible
All of these don't seem like super-critical to me, unless someone really takes their time and tries to exploit these potential vulnerabilities. From what I can tell, there are least 20,000 customers stored in their database. Also it seems like all the customer data is stored in one big table for all the different gyms that are using this application.
The kind of data that is stored about the customers seems to be very personal and shouldn't be in the wrong hands I guess. So I contacted this company anonymously and told them about my concerns. They responded to me a few days ago and said that they fixed everything - however I checked it and basically nothing changed in this web application (still the same vulnerabilities).
So here is my question: How should I proceed? Should I give them a second chance or contact some kind of data protection authority? And would you consider these problems/vulnerabilities critical? (like already said: I didn't dig too deep, but even with my limited security knowledge I think I could get most of the user data into my hands within a few days)