Cinfores is known for developing student management portals for schools, particularly in Nigeria (IMO). My interest in exploring potential vulnerabilities in their systems was sparked during my school registration process.

As part of the process, students were required to upload their documents to the school portal for admission verification. While finalizing my registration at the faculty office, a staff member informed me that my documents had not been uploaded. This led to a back-and-forth discussion before she asked me to log in to my portal and show her the uploaded documents directly.

When I logged in, I discovered that my documents were indeed not uploaded. However, I noticed something that piqued my interest—a message within an else statement and an API route to fetch my documents. This small oversight by the developers confirmed my long-held suspicion that Cinfores likely operates using PHP and MySQL.

Although I left the office, the experience lingered in my mind. I couldn’t stop thinking about potential vulnerabilities within the system, which led me to consider performing unauthorized penetration testing on my school’s website.

Powered by Froala Editor