<html><body>
<p><font size="2" face="sans-serif">Hi,</font><br>
<br>
<font size="2" face="sans-serif">the penetration test in my company shows big issue according "onDemand" dropoff for non registered users.</font><br>
<ul type="disc" style="padding-left: 18pt">
<li><font size="2" face="sans-serif">foreign user gets dropoff-auth with valid email-address after Recaptcha</font>
<li><font size="2" face="sans-serif">user uploads files to Zendto with a non-existing email-address of my company (for example --> nonexisting@kaufland.com)</font>
<li><font size="2" face="sans-serif">user gets dropoff summary</font></ul>
<br>
<img src="cid:1__=4EBBF222DFA006B68f9e8a93@de.int.kaufland" width="1020" height="556"><br>
<ul type="disc" style="padding-left: 18pt">
<li><font size="2" face="sans-serif">in the source code of dropoff.php you can see the </font><font size="2" face="sans-serif"><b>claimid</b></font><font size="2" face="sans-serif"> and </font><font size="2" face="sans-serif"><b>claimpasscode </b></font><font size="2" face="sans-serif">as hidden input fields</font></ul>
<br>
<tt><font size="3"><form name="deleteDropoff" method="post" action="https://share.kaufland.com/delete.php"><br>
<input type="hidden" name="claimID" value="JikPnNT7eDMCr9g7"/><br>
<input type="hidden" name="claimPasscode" value="YtKuUMXQzcrMkAtd"/></font></tt><br>
<br>
<br>
<font size="2" face="sans-serif">The foreign user could send the </font><font size="2" face="sans-serif"><b>claimid</b></font><font size="2" face="sans-serif"> and </font><font size="2" face="sans-serif"><b>claimpasscode</b></font><font size="2" face="sans-serif"> to a lot of users, like a filesharing platform!</font><br>
<br>
<font size="2" face="sans-serif">From this point of view its a big security issue!</font><br>
<br>
<br>
<font size="2" face="sans-serif">Mit freundlichen Grüßen / Best regards<br>
<br>
Patrick Gaikowski<br>
Tel: +49 7132 94 3568<br>
Fax: +49 7132 94 73568<br>
E-Mail: patrick.gaikowski@kaufland.com<br>
KI 967800 IT International / Infrastruktur<br>
Office:<br>
Lindichstrasse 11<br>
D-74189 Weinsberg</font><br>
<br>
<br>
<font size="2" face="sans-serif"><a href="http://www.kaufland.de">http://www.kaufland.de</a> </font><br>
<font size="2" face="sans-serif"><a href="http://www.spannende-it.de">http://www.spannende-it.de</a></font><br>
<font size="2" face="sans-serif">Wir sind die Nr. 1:</font><br>
<font size="2" face="sans-serif">Kaufland ist "Bester Lebensmittelmarkt 2011"!</font><br>
<br>
<font size="2" face="sans-serif">Kaufland Informationssysteme GmbH & Co. KG</font><br>
<font size="2" face="sans-serif">Postfach 12 53 - 74149 Neckarsulm<br>
Kommanditgesellschaft<br>
Sitz: Neckarsulm<br>
Registergericht: Amtsgericht Stuttgart HRA 104163</font><br>
<br>
<br>
<br>
<br>
<br>
</body></html>