Monday, February 17, 2025
HomeComputer SecurityIRCTC Website Flaw Allow Hackers to Access All Your Private Info &...

IRCTC Website Flaw Allow Hackers to Access All Your Private Info & Cancelling Booked Tickets

Published on

SIEM as a Service

Follow Us on Google News

A new bug discovered in IRCTC website allows attackers to gain access to the lakhs of users private information and alter the sensitive data include cancelling the booked ticket.

IRCTC (Indian Railway Catering and Tourism Corporation) is a part of Indian Railway and one of the busiest Railway booking system in the world that manages around 15 to 16 lakh tickets every day.

An Indian Security researcher Ronnie T Baby who discovered this critical vulnerability in the password reset option that used in IRCTC.

During the process of login, When input the user id, an OTP gets automatically sent to the registered mobile number of the account. 

In this case, Ronnie said, “Though there was captcha enabled to prevent brute-forcing of the OTP’s, it surprisingly allowed the reuse of captchas for unlimited requests.”

Cancelling IRCTC Booked Tickets

Initially targetted user ID is required to exploit the bug and it is not a big deal to found the variety of user ID online, here you can see some of Top 100 common names in India.

If any users try to reset their password, 6 random character OTP gets generated and send it the users registered mobile number.

Researcher said, “After a little observation I found that, there is indeed rate limiting to the amount of OTP being sent (it will say that your account has exceeded the OTP limits for the day…). But here the issue was the reuse of valid captchas”

Since the OTP contains a 6 digit corrector, attackers can easily validate the OTP using a variety of brute force tools available online for the maximum checking count of 999999.

During the process of OTP Validation, a parameter called “seqAns ” helps to validates if the OTP matches the one sent on mobile number. 

Ronnie said to “GBHackers on Security” via Email, I could have hacked lakhs of IRCTC accounts and get access to all your private info including easily cancelling booked tickets by repeated request while changing the value of seqAns to reset the password and login to IRCTC user account after observing that correct OTP.”

Here you can see the Proof of concept video that was published online.


Ronnie reported this vulnerability to IRCTC and the bug was fixed by proper captcha verification.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:

Rail Operator website Hacked and Hackers asked to Pay Ransom in Bitcoins

Massive DDOS Attack on Denmark Railway System that Make Impossible to Buy a Train Ticket


Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Android’s New Security Feature Prevents Sensitive Setting Changes During Calls

Phone scams are becoming more sophisticated with advancements in AI-driven speech tools, making it...

Hackers Exploit Microsoft Teams Invites to Gain Unauthorized Access

The Microsoft Threat Intelligence Center (MSTIC) has uncovered an ongoing and sophisticated phishing campaign...

Meta’s Bug Bounty Initiative Pays $2.3 Million to Security Researchers in 2024

Meta's commitment to cybersecurity took center stage in 2024 as the tech giant awarded...

Google Chrome Introduces AI to Block Malicious Websites and Downloads

Google has taken a significant step in enhancing internet safety by integrating artificial intelligence...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

NVIDIA Container Toolkit Vulnerable to Code Execution Attacks

NVIDIA has issued a critical security update to address a high-severity vulnerability discovered in...

Apache Fineract SQL Injection Vulnerability Allows Malicious Data Injection

The Apache Software Foundation has disclosed a critical SQL injection vulnerability in its widely...

AMD Ryzen Flaw Enables Code Execution Through DLL Hijacking

A security vulnerability has been identified in the AMD Ryzenâ„¢ Master Utility, a performance-tuning tool for AMD Ryzenâ„¢...