2 ms·
After looking at this for a while, I don't see any SSN in the source or any external scripts. The original stltoday article said the information was "contained
by tantalor 5y ago
After looking at this for a while, I don't see any SSN in the source or any external scripts.
The original stltoday article said the information was "contained in the HTML source code" but that seems to be not the case.
- stefan_ 5y agoWhy would there, you haven't searched for anything. Even ASP.NET isn't terrible enough to send over the entire freaking database when just loading the form.
- tantalor 5y agoIt matters because it contradicts what the newspaper published. In my opinion, the "html source" means the document as it was sent over the wire before JavaScript modifies the document.
- amznthrwaway 5y agoYou’re not looking at the page served as a response to a search.
- willvarfar 5y agoCan’t see a contradiction. It’s easy to imagine that ssns are in search results. Eg it’s plausible that when you search for a teacher, the returned html contains tags with id where that is the primary key in the DB, which happens to be the Ssn etc.
- tyingq 5y agoThis is the search form. The problem is most likely in the page this posts to, with the search results. Still interesting, but this page doesn't answer many questions.
- TigeriusKirk 5y agoAs far as I've seen, no one has given a clear description of the actual vulnerability. Just what they imagine it was based on 3rd or 4th hand relayed descriptions.