Australia Post had withdrawn its Click and Send online service after a security flaw was uncovered that could expose the details of random customers.
News.com.au reported the insecure direct object reference vulnerability, which allegedly enabled users to expose others' details by altering a shipping ID number that appeared in the URL of a completed transaction.
Click and Send could be used to prepare postage documentation online, such as customs declaration forms, and pre-pay postage.
The service was particularly targeted at eBay customers, streamlining the way they sent items they had sold on the auction site.
Australia Post said in a statement that Click and Send had been "temporarily suspended due to a system error".
The service, which is now restored, was initially re-activated with another flaw that allowed customer names to be viewed, news.com.au reported.
A system administrator tipped off News Limited to the flaw after he allegedly reported it three times to Australia Post.
The organisation did not appear to have a formal information security reporting structure.
.png&h=140&w=231&c=1&s=0)
.png&w=100&c=1&s=0)
Private AI vs Public AI: How your organisation can securely adopt AI without compromise and excessive cost
iTnews Benchmark Security Awards 2025
Digital Leadership Day Federal
Government Cyber Security Showcase Federal
Government Innovation Showcase Federal
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
