Vulnerability in SuperINN Plus web application impacts over 43,000 customers

guest · Aug 9, 2019

Vulnerability in SuperINN Plus web application impacts over 43,000 customers
Sark Notice of Data Security Incident (California) (PDF - 404 KB): https://oag.ca.gov/system/files/Sark%20Notice%20of%20Data%20Security%20Incident%20%28California%29_1.PDF

SuperINN.com’s investigation determined that the data security incident affected approximately 43,250 individuals residing across the U.S. and in 64 other countries, including 2,882 residents of California.

One or more attackers identified a vulnerability in an image upload function of the SuperINN Plus web application available to authenticated users that allowed the attacker to upload PHP web shells. The earliest of these web shells found on the system was dated September 23, 2018.

Correlated with these web shells the investigation identified PHP scripts used to export
data from the SuperINN Plus database, including encrypted card numbers, names, home and credit card billing addresses, telephone numbers, and email addresses of SuperINN.com’s customers’ guests.
In addition to the PHP web shell, an attacker identified a SQL injection vulnerability in the web application and appeared to make use of it to pull encrypted cardholder data from the database.
Click to expand...

Log in or Sign up

Vulnerability in SuperINN Plus web application impacts over 43,000 customers

guest Guest

Log in or Sign up

Vulnerability in SuperINN Plus web application impacts over 43,000 customers

guest Guest

Useful Searches