← back to suncloud

SEVERITY RATING: 7.6/10

Your school management website "axcel.schoolmgmtsys.com" has a major MD5 bug which allows an attacker to generate many MD5 hashes to guess and grab invoices from people, thus the attacker has access to your student's invoices which contains:

how the bug works:

The attacker uses an endpoint in your management site which is called getpdf.php. Normally, it should act as a safe gateway to a pdf. Unfortunately this getpdf.php's authentication system has a major flaw. The authentication system (MD5) is derived from the Invoice No. text which is predictable (it is sequential). An authentication system should NOT be predictable. An attacker could reverse engineer the authentication system which should NOT be possible for a secure system.

my understanding of the authentication system

The authentication system hash is an MD5 hash. While an MD5 hash is not possible to decrypt, the hash can be easily recreated from scratch with an invoice pdf.

The reverse engineering

The getInv? param in the url should be an MD5 hash but this param does not qualify and check if its an MD5 hash. Lets say I put something random inside like "https://axcel.schoolmgmtsys.com/getpdf.php?getInv=test". Instead of rejecting it, the system for some reason puts the param in the "Invoice No." box. It should reject with an error or at least a blank page. This led me to compute the MD5 hash of my own Invoice No. (example: AIBP2021-1001). The hash I computed matched the value already present in the getInv URL parameter, confirming that the parameter is simply an MD5 hash of the Invoice No.

simplified explanation on how to replicate it

  1. Log in to the school portal and open your own invoice
  2. Then check out your Invoice No. (e.g. AIBP2021-1001)
  3. Make a MD5 hash that is from that invoice number
  4. Visit https://axcel.schoolmgmtsys.com/getpdf.php?getInv=[your hash]
  5. Observe that your invoice PDF loads successfully
  6. Now increment the invoice number (AIBP2021-1002), generate its MD5 hash
  7. Replace the hash in the URL… another student's invoice loads without any login check

what should the system do?

The MD5 hash should be stored properly. It should be derived from a value that is not guessable, sequential and not visible. Before showing the pdf, make sure the user actually is a user (check the session cookie and authentication against the database) and is logged in.

how many invoices are at risk?

An estimated number of: 4986 invoices at the end of the year (2026).

how did I get this number?