How I Hacked a Cybersecurity Training Academy!

Note on redaction & responsible disclosure This blog is educational. To respect the vendor I have deliberately redacted the organisation's name, all hostnames/URLs, internal identifiers, secrets, tokens, student PII and specific media links. I refer to the target only as "the Academy" and use placeholder domains such as academy.example / <mgmt-host>. The findings below were reported through the Responsible Disclosure Programme and remain subject to its disclosure policy.

TL;DR

A commercial indian 🔥 cybersecurity training academy — a company whose entire business is teaching people how to secure software web apps (and which also sells cybersecurity services to other orgs) — shipped an admin API that trusted [redact] logged‑in student. With a free, unverified learner account I could:

• Dump every student's full name, email, phone, DOB, address, guardian details and bcrypt password hash (~2,200 records) from a single GraphQL query.

well , found it after just finished graphql labs on portswigger.😂

• Read every paying student's financial records (course fees, discounts, outstanding EMIs, invoices) — and 47 trainers/coaches' names, emails and phone numbers.
• Take over any account by overwriting its email + password through an admin mutation (updateStudentProfile) — full account takeover, victim permanently locked out.
• Reach the entire admin mutation surface (52 mutations): grades, attendance, certificates, cohorts, classes, payments, course assignments.
• Read the exam question banks including the correct answer fields, students' uploaded CVs, signed consent forms, support tickets and the full sales/leads pipeline.
• Trigger OTP emails and SMS to arbitrary recipients using the Academy's own mail/SMS gateways, plus a hardcoded API secret in their frontend bundle — and they provide cybersecurity content btw. 🔥
• Enumerate which emails have accounts and read cohorts, class schedules, Google Meet joining links and recorded lecture links for courses I was never enrolled in — some of the recordings were stored on publicly shared Google Drive.

Root cause in one line: [redact] decision, and mounted its admin GraphQL schema on the same consumer endpoint.

peak backend developement.

well detailed blog will publish soon only if they fix all stuffs. looks like they are too busy to count students mon* rather than securing org....😴.