Developer Michael Lynch filed an RMA with the used storage vendor goHardDrive (GHD), and in the process, accidentally discovered that the company is leaking customer details through an insecure RMA status check portal. According to his blog post, you can check the status of any GHD RMA through ghdwebapps.com/rma by inputting the RMA number, which is in this format: GHD00000. This will then pull up a sheet that outlines the customer’s details, like name, mailing address, email address, phone number, order number and date, and the products to be returned, plus the reason for the return.
All this information would not be an issue if the form were private. However, anyone can input any valid RMA number, and the website will return all this information without any authentication that you own the RMA. GHD also used the following URL to show all that data: https://ghdwebapps.com/rma/check?rmaNo=GHD12345&fromButton=1.
