How I Found 2 Critical Vulnerabilities in One of Nigeria’s Largest Institutions
A security research writeup from my notebook.
Expand detailsHide details
Two IDOR flaws in a student portal exposed personal profiles and academic transcripts to other authenticated students. Responsibly disclosed and published after remediation.
Student profile exposure
A logged-in student could change a user identifier and retrieve another student's personal profile because the API did not check access to the requested record.
Impact
Exposed names, dates of birth, contact information, next-of-kin details, and academic profile data.
Transcript download authorization bypass
The results view rejected access to another student's records, but the separate PDF download route lacked the equivalent authorization check.
Impact
An authenticated student could download another student's full academic transcript.
Disclosure & remediation
- Discovered during a private security assessment
- Responsibly disclosed to the institution
- Published after remediation
The published timeline states that the institution was notified and the details were released after remediation. Fix details, dates, and a CVSS score are not provided in the article.