TAR UMT Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

Tunku Abdul Rahman University of Management and Technology (TAR UMT) is a major Malaysian higher education institution with a rich history evolving from TAR College. The institution manages student records for tens of thousands of students across multiple faculties, financial aid and fee processing, academic transcript generation, LMS (Moodle-based e-learning platform), examination management systems, library systems, hostel and accommodation databases, staff payroll and HR systems, and administrative dashboards.

Database access (SQL injection, exposed DBMS endpoints, backup file exposure) and admin panel compromise are the highest-value attack vectors — they unlock PII for the entire student body, fee/payment redirects, grade alteration capabilities, and downstream lateral movement into campus infrastructure. Each proven critical pays $5,000 USD.
In scope: tarc.edu.my web portals, APIs, LMS, admin dashboards, backend services, and any other TAR UMT-operated infrastructure.
Civil exclusions only: blackmail, mass student harassment, brute forcing wholly unrelated external bank accounts. Those bans are universal — not SKU-level scope fences.

There is exactly one bounty amount on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows require attacker-readable kill chains and replayable exploitation artefacts (Burp exports, parallel request harnesses, SQLi dump captures, SSO token forgeries, signing traces…).

These rows do not impose limits — they’re shorthand for tagging reports. Anything TAR UMT operates, sponsors, or delegates authentication for sits under this umbrella. Submission tarc.edu.my triggers the timetable below.

Sandbox student portals, canary databases, Grafana for campus systems, Telegram/bot hooks for admin alerts, partner LMS or library integrations fronted by TAR UMT — all eligible when critical impact reproduces. Database access and admin panel compromise are the primary targets.

• Vanity subdomains CNAME’d into TAR UMT edge — show DNS/traffic proof in your write-up.
• Mobile app SDKs or widgets TAR UMT ships to students/staff
• Research grant management systems operated under tarc.edu.my
• Internal database endpoints, phpMyAdmin, exposed DBMS ports, backup files
• IoT or smart-campus callbacks verified with TAR UMT-issued secrets

1. Prove exploitation success. Provide scripts, HARs, parallel request captures, or signing traces showing data/state impact — not paper analysis alone.
2. Number your hops. Session/API primitive → escalation → database/admin/payment integrity break.
3. Minimize real-user blast radius. Prefer mirrors, low-value accounts, and reversible payloads when demonstrating theft-class bugs.
4. Private coordination first. Use official intake on tarc.edu.my before public threads.
5. Duplicate fairness. First qualifying PoC wins; followers close acknowledged-only.

Use the security / vulnerability disclosure contact published on https://www.tarc.edu.my/ (security@tarc.edu.my is a common guess — verify on the live site before emailing). Template below.

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — database/admin/student impact in one paragraph

# Severity self-classification → must map to TAR UMT critical definitions above

## Attack chain narrative (numbered, no gaps)
1. Preconditions (session, API key tier, endpoint, account ID)
2. Entry primitive — HTTP/WS line + signature headers
3. Pivot(s) → privilege/data/payment escalation
4. Final hop → DB exfil / admin takeover / payment diversion / infra takeover equivalent

## Successful exploitation evidence
• Scripted replay showing record/payment impact
• Paired HAR/PCAP demonstrating cross-user data access
• SQLi dump output or database connection proof
• Signing or token trace if SSO/crypto primitive involved

# Remediation suggestion (optional but appreciated)
• Short description of expected fix orientation

# Attachments (zipped, <10 MB, no malware)
- PoC script.py, capture.har, logs/

Pseudocode illustrating admin panel session replay leading to database access — meaningless without attaching HAR/logs proving an unauthorized request retrieves protected data inside tarc.edu.my.

# BUGGY: admin panel trusts session cookie without IP/scope binding
import requests

BASE = "https://tarc.edu.my/admin/api/v1"
SESSION = "eyJhbGciOiJIUzI1NiIs..."  # captured admin session

def export_students(db_table):
    resp = requests.get(
        f"{BASE}/export/{db_table}",
        headers={"Cookie": f"tarc_admin_session={SESSION}"}
    )
    if resp.status_code == 200:
        return resp.json()
    return None

# Proof: attach HAR showing 200 response with student records
# Proof: attach DB dump snippet showing exfiltrated rows