Chandra R. Srikanth@chandrarsrikant
How a CBSE student uncovered a security flaw in a national exam portal
"I got curious," Nisarga Adhikary told Moneycontro's @AihikS in an interview. "They had rolled out a new portal (cbse.onmark.co.in) for digital evaluation of copies. I started looking around and found the domain. Teachers were already using it and there were videos about it online."
Adhikary said he did not possess any credentials to access the system. Instead, he examined the website's publicly accessible JavaScript files — code that is automatically downloaded by any browser visiting the portal.
"I came across the master password thing," he said. "It was not hashed. It was literally hardcoded in the code."
According to Adhikary, the password could be located through a simple keyword search -- Control +F-- within the code bundle. Using publicly obtainable user identifiers and school IDs, he said he was able to access the portal.
In his blog post, Adhikary detailed several alleged vulnerabilities in the system, including client-side OTP validation, exposed credentials and insufficient access controls. He described the flaws as "amateur mistakes" that required little sophistication to exploit.
“This is a really big security blunder,” he said. “Anyone with a browser can read the code. You don't even need sophisticated exploitation. One Ctrl+F search and you can find the password.”
moneycontrol.com/technology/big…