Dodo customers exposed by insecure direct object reference hole

Name, address, phone numbers and account details of Dodo Power and Gas customers have been exposed thanks to two security gaffes which made online statements publicly accessible.

Users could access accounts for up to 500 customers via an insecure direct object reference vulnerability which granted access when URL address were correctly manipulated.

The flaw was one of the most common affecting online websites.

The number of affected Dodo Power and Gas customers was limited to between 100 to 500 people because the statements were posted only at a customers' request,

Each statement was made available for "a number of hours", Dodo chief Larry Kestelman told the SMH which first reported the story.

The statements were supposed to be deleted earlier by an automated script which had failed.

Kestelman said the company had fixed the flaw.

Copyright © SC Magazine, Australia