Southern Water - British supplier of the liquid of life - botched its internal Sharepoint implementation so badly that a customer was able to view other people’s account details.
Reg reader Chris H discovered that the way Southern Water had set up Sharepoint to host customer information as a “your account” style section of their website exposed URLs that could be tweaked to view other people’s account information.
“Unfortunately, a vulnerability in this management area allowed any logged in customer to view bills and documents from other customers, as well as retrieve authentication tokens which allowed for direct API access to their internal billing SharePoint site,” wrote Chris in a Medium blog post about the problem.
PDFs loaded through the customer portal included a URL string as so:
https: ..
Support the originator by clicking the read the rest link below.
