Couriers Please parcel tracking data exposed by SQLi

A SQL injection (SQLi) vulnerability has been found on the website of delivery service Couriers Please which could reveal parcel tracking details.

SQLi occurs when an attacker sends hostile code through a web form, resulting in the execution of unintended commands or access of unauthorised data.

Security researcher Joshua Rogers reported finding the common website flaw on the Couriers Please site on Sunday. The flaw has since been fixed.

Rogers said in a post the vulnerability revealed customer names, postal and email addresses and signatures, but declined to cite further  details due to confidentiality agreements.

Injection was the most critical risk identified by the OWASP Top Ten.  

OWASP states: "The best way to find out if an application is vulnerable to injection is to verify that all use of interpreters clearly separates untrusted data from the command or query.

"For SQL calls, this means using bind variables in all prepared statements and stored procedures, and avoiding dynamic queries."

Check out the OWASP SQLi prevention cheat sheet for more information.

Copyright © SC Magazine, Australia