How I Found 8 Vulnerabilities on an HP Student Portal

I was studying for my Sem-Exam, a image was being circulated in my class group, it was about student offers and discounts on HP products, I didn't think much of that as I was not looking for a Laptop.

But I don't know why, my mind said let me check once, so I opened the site, there was a form to fill, where you have to register using OTP, out of instinct I opened the page source, and to my surprise firebase config key was visible in the front-end, I thought that was a big discovery, but later I came to know that, firebase API key were meant to be public. leaving that aside, I looked through the source code, simply because I was bored from studying chemistry for the past two days, even though the exam was in the very next day, I scrolled a bit in the source code and I saw something interesting, OTP was being confirmed in the client side instead of server side, on further test I came to conclusion that I was correct.

To confirm that I put a break-point on the very line the otp was being verified, and hovering over that variable, it showed the correct OTP. Further there was no protection against brute force on OTP validation.

Not only that but on further check it was also vulnerable to IDOR, using the details of its firebaseConfig, I was able to send a request in which the parameter was the phone number and I was able to retrive all the details. All I needed was a phone number.

And there were 6 more vulnerability, some were of low severity.

I crafted a report with PoC as screenshot and sent them via mail, in few hours I got the mail confirming this report and it was assigned with the case id: PSR-2026–0142. This made me very happy, getting an acknowledgement mail from one of the fortune500 company wasn't something I thought I can achieve in my first year Engineering.

After a day later the site was giving 404, saying its temporarily unavailable, So I waited for a month for them to fix the issue.

A month later, that site now redirects to a Whatsapp chat, so that website is no more,

They sent me the final email saying that the case is now closed. NOTE: All testing was performed only on my own account, and no unnecessary third-party data was accessed or retained.

Thank you.