Bug in student admissions website exposed children’s personal information

A pupil admissions website utilized by families to enroll children into schools has fixed a information lapse that was exposing their idiosyncratic information.

The website, Ravenna Hub, which lets parents use and way the presumption of their kids’ applications crossed thousands of schools, was allowing immoderate logged-in idiosyncratic to entree the personally identifiable information associated with immoderate different user, including their children.

The exposed information includes children’s names, dates of birth, addresses, pictures, and details astir their school. Email addresses and telephone numbers of parents, arsenic good arsenic accusation astir children’s siblings, were besides exposed.

Florida-based VentureEd Solutions, which develops and maintains Ravenna Hub, says connected its website that it serves implicit a cardinal students, and processes hundreds of thousands of applications a year.

TechCrunch archetypal learned of the vulnerability connected Wednesday and soon aft alerted the company. VentureEd fixed the bug the aforesaid day, but TechCrunch held this study until we could verify that the bug was fixed.

Nick Laird, the main enforcement of VentureEd Solutions, told TechCrunch successful an email that the institution was capable to replicate the contented and has addressed the vulnerability.

Laird said the institution was investigating the incident, but helium would not perpetrate to notifying users astir the information lapse, oregon accidental — erstwhile asked by TechCrunch — if the institution has the quality to cheque if determination was immoderate improper entree to different users’ data. We besides asked if Ravenna Hub had its information checked by a third-party, and if so, by whom. Laird would not say, and declined to remark further.

It’s not wide who, if anyone, oversees cybersecurity astatine VentureEd and Ravenna Hub.

The vulnerability is known arsenic an insecure nonstop entity reference, oregon IDOR, a common information flaw that allows users to entree stored accusation due to the fact that of anemic oregon non-existent information controls connected the acrophobic servers. 

In practice, the bug would person allowed immoderate logged-in idiosyncratic to entree different student’s exertion file, including their idiosyncratic information, by modifying the unsocial fig associated with a student’s illustration utilizing their web browser’s code bar. 

In the lawsuit of Ravenna Hub, pupil numbers are sequential, meaning it was imaginable for immoderate idiosyncratic to entree different student’s information by changing the illustration fig by 1 oregon much digits.

When TechCrunch created a caller relationship with trial data, we recovered that the web code contained a seven-digit number. As such, determination were somewhat much than 1.63 cardinal records anterior to ours that were accessible to immoderate different user.

This is the latest information lapse involving elemental information flaws affecting the idiosyncratic accusation of children. In January, online mentoring tract UStrive exposed the idiosyncratic accusation of its users, galore of whom are inactive successful school.