Weak Security and Vulnerabilities in the Portuguese Government's Auth System

Posted by iluxonchik on Sunday May 13, 2018 @12:18PM
from the iluxonchik.github.io dept.

https://iluxonchik.github.io/weak-security-of-portuguese-government/

( 3 comments | 16 points | on HN )

Re:Weak Security and Vulnerabilities in the Portuguese Gover... by mmoura11s on Monday May 14, 2018 @09:13AM (#17065168)

Is the XSS exploitable? Can you insert data in the phone field via a form submit or URL param? Seems like the attack requires exceedingly unlikely user interaction.

Did you contact the Portuguese National Data Protection Agency? If you can leak phone numbers, they should be informed.

Cool findings :)

[ Parent | on HN ]

Re:Weak Security and Vulnerabilities in the Portuguese Gover... by iluxonchik on Monday May 14, 2018 @08:02PM (#17070510)

Thank you :)

Regarding the XSS attack, I have the answer here: https://iluxonchik.github.io/chave-movel-digital-xss/#commen...

I did not, thank you for suggesting, I will do it now.

[ Parent | on HN ]

Re:Weak Security and Vulnerabilities in the Portuguese Gover... by vmateixeira on Monday May 14, 2018 @05:16AM (#17063968)

When your cousin's software consultancy company is hired...

[ Parent | on HN ]