SEVERITY RATING: 8/10

Your school management website has a critical issue with your API endpoint https://axcel.schoolmgmtsys.com/dashboard/profileImage/{photonumber}.

The API endpoint is UNPROTECTED and does not have an authentication layer over it, thus allowing attackers to guess the number and get PII identifiable images of kids and teenagers. The API endpoint can be easily accessible with a browser and some common sense — the photo number can be guessed and the API endpoint will return with an image of kids and teenagers.

How to replicate

1. Visit the endpoint with the starting number 1000
2. A student photo loads
3. Guess the numbers to load more photos
4. Invalid photos are just the placeholder photos

Consequences:

• Unauthorized access to children's photos
• Photos can be used for identity theft, impersonation or very malicious purposes
• Violates student privacy and child safety laws

My Solution

Make the API endpoint authenticated by only allowing that specific photo number to the person, and require an account to access it.