Shulou(Shulou.com)11/24 Report--

CTOnews.com, June 9 (Xinhua)-- researchers have found an API vulnerability in the Honda Group e-commerce website, which is the parent company of Honda Motor, which may allow hackers to obtain orders, emails, financial and other information from customers and dealers.

Eaton Zveare, a researcher at ▲ Image Source Eaton Zveare, said that by using the password reset function of the website, he directly reset the webmaster account, and then only needed to modify the web page URL to see the information of all Honda dealers, including reading customer email information, and even directly modifying the website and product information.

▲ source Eaton Zveare he also found a "fake identity" loophole in the administrator page of the Angular-based dealer website, enabling him to pretend to be a Honda administrator and get all the dealer website information, including the customer relationship diagram, the number of dealers subscribed to the website service, the total income of the enterprise, and other information.

▲ Touyuan Eaton ZveareZveare said that through the loopholes in Honda's website, it has obtained as many as 21000 customer information, more than 10,000 customer email addresses, more than 1000 dealer email addresses, more than 2000 dealer websites, Paypal payment addresses of 3600 dealer accounts and internal financial statements from August 2016 to March this year.

CTOnews.com noted that Honda had fixed these vulnerabilities as of press time, but so far there has been no official response.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.