Couriers Please parcel tracking data exposed by SQLi

By

Company fixes website hole.

A SQL injection (SQLi) vulnerability has been found on the website of delivery service Couriers Please which could reveal parcel tracking details.

Couriers Please parcel tracking data exposed by SQLi

SQLi occurs when an attacker sends hostile code through a web form, resulting in the execution of unintended commands or access of unauthorised data.

Security researcher Joshua Rogers reported finding the common website flaw on the Couriers Please site on Sunday. The flaw has since been fixed.

Rogers said in a post the vulnerability revealed customer names, postal and email addresses and signatures, but declined to cite further  details due to confidentiality agreements.

Couriers Please confirmed to SC the parcel tracking database was exposed and that the flaw had been fixed.

Injection was the most critical risk identified by the OWASP Top Ten.  

OWASP states: "The best way to find out if an application is vulnerable to injection is to verify that all use of interpreters clearly separates untrusted data from the command or query.

"For SQL calls, this means using bind variables in all prepared statements and stored procedures, and avoiding dynamic queries."

Check out the OWASP SQLi prevention cheat sheet for more information.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

Log In

  |  Forgot your password?