HexBrain

Khan Academy · Report #1210043

Enumerate all the class codes via google dorking

Validstatus
highseverity
44upvotes
22 Jul 2021disclosed

How it was found

I used this particular google dork site:khanacademy.org/join/* to enumerate all the links of joining classes.

  1. Go to google and use the above query to enumerate all of them.
  2. Create the student account by filling all the required details
  3. Now you're in the class without being actually invited by the teacher

Attached POC: ████████

Impact

An attacker can enumerate all the classes and join in them and make chaos there are chances of IDOR too... a class code can look like a57d5d5548f302ef4a instead of A45JST

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original