USING COOKIES TO HACK INTO A TECH COLLEGE'S ADMISSION SYSTEM

Summary from the TLDR InfoSec newsletter

Sri Krishna College of Engineering and Technology's SparK admission system exposed 4,110 student records because its admission APIs lacked any authentication, allowing access via manually set login cookies. By crafting two cookies and then harvesting a valid admission officer GUID from a student search response, researchers could fully impersonate an officer and reach sensitive dashboards. The exposed data included IDs, medical details, religious and ethnic information, grades, income data, and private documents for both students and parents, all accessible with only a browser. After coordinated disclosure through India's CERT-IN, SKCET took the vulnerable site offline within a week and later restored it with the flaw fixed.