StaySafe COVID19 Tracker hacked, Admin access obtained with all user data

[Hyaenidae]

https://rukshn.github.io/how-i-hacked-stay-safe-covid-tracker/

 

[හෙනයා]

man daanna kiyala haduwa witharai

habai Hiranya daala thibba serama patched kala kiyala

 

[Hyaenidae]

habai Hiranya daala thibba serama patched kala kiyala

Press X to doubt

 

[batwise]

dan hadala ne

 

[හෙනයා]

Press X to doubt

saw in the GovTechSL slack channel. other than that idk

 

[asylum]

bump.

 

[Die-hard]

ඔය api එක public වෙලා තිබ්බේ..ගිය අගහරුවදා එළකිරි එකේ මන් දාලා ඇති url එක

 

[bawa_gardens]

Amateurs

 

[Heshan Daminda]

ඔකේ රෙජිස්ටර් වෙයන් කියල මම ත්‍රෙඩ් දැම්මට මේකේ උන් අල්ලාගෙන මට තඩිබායිද?

 

[saja]

තඩිබායිද? ow තඩිබානන තමා වෙන්නේ , හැම වෙලාවේම QR scan කලාම registration form fill කරන්න අහන්න නිසා

ඔකේ රෙජිස්ටර් වෙයන් කියල මම ත්‍රෙඩ් දැම්මට මේකේ උන් අල්ලාගෙන මට තඩිබායිද?

wadak appa oya StaySafe eka , ada giya handiyata , bank ATM eka gawa QR code eka tibba , mama scan kala , menna ayith registration form eka fill karanna ahanawa , mama giye week eka public registration form eka fill kala , wadak na ne oka 100 parak fill karanna one ne

mata penne kohe hari yanna issara phone eke log wela inna weyi wage , ethakotawath registration ahanne nath nam maru

 

[dayt0na]

Hehehe

 

[bonty89]

 

[NFC]

bmp

 

[saraprobe]

https://rukshn.github.io/how-i-hacked-stay-safe-covid-tracker/

Don't post things here that can compromise national security
Don't be a d*CK and play games with your country
Let me report these users to Cops
Enjoy!!!!

 

[asiridol]

Don't post things here that can compromise national security
Don't be a d*CK and play games with your country
Let me report these users to Cops
Enjoy!!!!

So posting here is bad but putting the national security at risk by not taking industry wide accepted steps to protect user security is Ok? #amateurhour

 

[nkt]

Don't post things here that can compromise national security
Don't be a d*CK and play games with your country
Let me report these users to Cops
Enjoy!!!!

haha let's see if he replies to you

 

[malakadss]

Don't post things here that can compromise national security
Don't be a d*CK and play games with your country
Let me report these users to Cops
Enjoy!!!!

they did an incomplete cheap job. So blaming others is useless. Its their fault and they must admit it and correct it

 

[asiridol]

To add to that big companies like apple facebook google spend millions of dollars in bug bounty programs. These fuckers should be grateful for receiving a proper pen testing report for free of charge.

 

[buddikagayan]

තඩිබායිද? ow තඩිබානන තමා වෙන්නේ , හැම වෙලාවේම QR scan කලාම registration form fill කරන්න අහන්න නිසා



wadak appa oya StaySafe eka , ada giya handiyata , bank ATM eka gawa QR code eka tibba , mama scan kala , menna ayith registration form eka fill karanna ahanawa , mama giye week eka public registration form eka fill kala , wadak na ne oka 100 parak fill karanna one ne

mata penne kohe hari yanna issara phone eke log wela inna weyi wage , ethakotawath registration ahanne nath nam maru

 

[saraprobe]

U

So posting here is bad but putting the national security at risk by not taking industry wide accepted steps to protect user security is Ok? #amateurhour

Report to authorities not gossip gangs here