|
Task Description
Security Report
Subject: Loss of Account Privileges Due to Exploitation of Academy Invitation Feature via Referral Code
—
Summary:
A critical vulnerability has been discovered in the academy invitation mechanism on the AlwaysData platform.
An attacker can exploit the referral system to cause any user (whether a teacher or a regular user) to permanently lose almost all account privileges, leading to near-total account disablement.
—
Technical Details:
Every user on AlwaysData has a unique referral code (for example: X) used to invite new users to register on the platform via the following link:
https://www.alwaysdata.com/en/register/?from=X Additionally, the same referral code is used to invite users to join the user's academy through the following link:
https://admin.alwaysdata.com/academic/attach/?teacher=X
Normally, users without academy administration privileges cannot invite members to an academy.
However, due to the way the invitation link is structured, any user can add themselves to their own academy by modifying the link and adding &attach at the end:
https://admin.alwaysdata.com/academic/attach/?teacher=X&attach
This link causes the user to immediately join their own academy without any notification or additional approval.
—
Attack Scenario:
1. Attacker’s Actions:
The attacker sends the victim their own academy invitation link (using the victim’s referral code):
https://admin.alwaysdata.com/academic/attach/?teacher=X&attach
As soon as the victim clicks the link, they are automatically added to their own academy.
2. Victim’s Actions:
After noticing that they have joined their own academy, the victim may manually leave it,
or they can leave directly using the leave link:
https://admin.alwaysdata.com/academic/detach/
3. After Leaving:
Once the victim leaves their academy, they permanently lose most of their account privileges:
Cannot access Permissions, Billing, Subscriptions, or other administrative sections.
Only able to edit personal information He can't even open a technical support ticket.
Any attempt to access protected sections results in a 403 Forbidden error message.
—POC: Ticket 86507
Impact:
Severe account disablement: The user loses full control over their account.
Data access loss: Access to billing, subscriptions, and key account settings is blocked.
Ease of exploitation: Only the referral code is needed.
Applies to all users: Both teachers and regular users are affected.
Can't open a technical support ticket
—
Recommendations:
Prevent users from joining their own academies using the referral code.
Modify behavior so that leaving an academy does not affect basic account privileges.
Disable automatic addition via &attach, or enforce additional verification before joining an academy.
—
Final Note:
This vulnerability allows any ordinary attacker, without special privileges, to completely cripple any user account with a single click.
It poses a very high security risk to user accounts and requires urgent remediation.
|
