Idea is the 3rd largest mobile services operator in India. Idea’s strong growth in the Indian telephony market comes from its deep penetration in the non-urban and rural markets. IDEA Cellular is an Aditya Birla Group Company, India’s first truly multinational corporation. The group operates in 26 countries, and is anchored by over 130,600 employees belonging to 40 nationalities. The Group has been adjudged the ‘6th Top Company for Leaders in Asia Pacific Region’ in 2009, in a survey conducted by Hewitt Associates, in partnership with The RBL Group, and Fortune. The Group has also been rated ‘The Best Employer in India and among the Top 20 in Asia’ by the Hewitt-Economic Times and Wall Street Journal Study 2007.
A critical SQL Injection vulnerability has been discovered in Ideacellular which compromises the entire site database. Any malicious smart black hats can create much more devastating attacks using this critical flaw such as: complete access to various database’s as shown in screen-shots under proof of vulnerability which can later be misused to access various confidential information; complete database dump; possibility of uploading shell (not fully certain) and much more. Vulnerable URL:
Proof Of Concept
- 25-Jun-2011: Sent an email to company along with POC.
- 17-Jul-2011: Reminder sent to the company.
- 01-Aug-2011: Second reminder sent.
- 20-Aug-2011: Public disclosure since no action has been taken by the company to fix the reported issue.
No data has been dumped; we randomly tried the security of Ideacellular web portal and in our very first attempt we discovered this critical flaw. Since this flaw was discovered in our very first attempt, existence of other flaws can’t be denied.
Database has been accessed just to take screenshots so that we can make company believe that the aforesaid flaw actually because most of the companies use to treat the like advisories/disclosure as junk and don’t believe the researcher’s which may later cause them huge.
We respect the confidentiality of Ideacelluar that’s why we have restricted the contents of our screen-shots to database tables only. We hope that Ideacellular will take some immediate steps to fix-up this critical vulnerability asap.