Dorm Mom Security Assessment 2022

📌 DormMom Security Assessment

Client: DormMom – Online Laundry Service for College Students
Engagement: Security Assessment & Consultation
Industry: Consumer Services – Online Laundry

🛡️ Overview

DormMom, a leading online laundry service for college students, engaged me for a security assessment and consultation following previous successful projects. During my review, I identified two critical Broken Access Control (BAC) vulnerabilities, which could lead to full account takeovers and unauthorized data modifications.

My assessment focused on:

1️⃣ Access Control & IDOR Testing
2️⃣ User Authentication & Session Security
3️⃣ Preventing Unauthorized Data Manipulation

The vulnerabilities discovered exposed user accounts and personal data to potential exploitation, requiring immediate remediation to secure the platform.

🔍 Findings & Key Issues

1️⃣ Full Account Takeover via IDOR
Severity: 🔴 Critical
Issue: A hidden input field in the profile update process allowed users to change their email address without validation.
Exploit: Attackers could modify another user’s email address, trigger a password reset, and fully compromise any account.
Impact:

• Total account takeovers, exposing personal and payment information.
• Loss of account integrity, allowing attackers to access order history and personal details.
  Fix:
  ✅ Replaced client-side ID handling with session-based authentication ($_SESSION instead of $_POST).
  ✅ Implemented server-side email change verification with multi-factor confirmation.

2️⃣ Unauthorized User Account Modifications
Severity: 🔴 Critical
Issue: Multiple portal forms relied on client-side ID parameters, allowing users to modify other accounts’ data.
Exploit: Attackers could manipulate form submissions to change another user’s phone number, special instructions, and delivery preferences.
Impact:

• Lateral account modifications, allowing unauthorized changes to user orders and personal details.
• Potential fraud & identity spoofing, enabling attackers to impersonate other users.
  Fix:
  ✅ Restricted modifications to authenticated user sessions.
  ✅ Removed direct database ID exposure from the frontend.
  ✅ Implemented access control checks to validate session ownership before processing changes.

📢 Outcome

✅ Replaced vulnerable ID-based authentication with secure session-based validation.
✅ Eliminated unauthorized account modification risks, securing DormMom’s user portal.
✅ Strengthened overall security posture, ensuring better protection of customer data.
✅ Delivered a detailed security report & remediation guidance, helping the DormMom team implement long-term security improvements.