A dating site for anti‑vaccination individuals has put the data of 3,500 users at risk.
See also: PrestaShop zero-day: Exploited to compromise online stores
“Unjected,” a dating site specifically for people who have not been vaccinated against COVID-19, failed to take basic precautions to keep user data safe, the Daily Dot reports.
Poor security left sensitive user data exposed, potentially allowing anyone to become an administrator of the site
The admin dashboard was fully accessible to anyone who knew how to search for it, so a malicious user could access user information for any member of the site, including their name, date of birth, email address , and home address.
See also: LockBit ransomware gang claims to have attacked Italian tax agency
The configuration error was discovered by a security researcher known as GeopJr, who confirmed the vulnerability on Daily Dot.
GeopJr noticed that the site had been published live on the web with “debugging mode” enabled.
This is a user interface used by software developers to allow them to view and manipulate the internal state of the program for debugging purposes. Obviously, leaving it enabled by default in a live application is a significant privacy threat.
Using this feature, the researcher was able to make almost any change to the website, including adding or removing pages, offering free subscriptions to paid services, or even deleting the entire database of backup posts.
Currently, the site is believed to have approximately 3,500 users, all of whose data is accessible if you know where to look.
The Unejected website states that it was created during the Covid-19 in spring 2021.
The site calls itself a “multi-faceted platform of health-conscious, unvaccinated people for Covid-19 who believe in medical freedom, freedom of choice, freedom of speech, and bodily autonomy.” It claims to have 110,000 members in 85 different countries.
See also: LinkedIn phishing campaign targets employees who manage Facebook Ad Accounts
In August 2021, the app was removed from the Apple App Store for violating Apple's Covid-19.
However, Android users can still download the app as it is currently listed on the Google Play store , where it has more than 10,000 downloads and an average rating of 2.5 stars.
Information source: metro.co.uk
