UTAR Edu Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

UTAR is one of Malaysia’s largest private universities, enrolling roughly 25,000 students across undergraduate and postgraduate programmes. The utar.edu.my portal aggregates student information systems (SIS), LMS/e-learning platforms, fee payment gateways, exam timetabling, academic transcript generation, hostel management, library systems, research repositories, staff intranets, and administrative dashboards. Database access and admin panel compromise are the highest-priority targets — each earns the full $5,000 bounty when validated with a working attack chain.

In scope materially: every HTTP host on utar.edu.my operated by UTAR, API endpoints, SSO integration (SAML/OAuth flows), payment gateway connectors, database servers accessible from UTAR infra, student and staff portal renderers, static deploy paths, session signing secrets, library system integrations, exam scheduling modules, hostel booking flows, research repository systems, mobile-responsive endpoints, and administrative dashboards.
Civil exclusions only: blackmail, mass student harassment, brute forcing wholly unrelated external bank accounts. Those bans are universal — not SKU-level scope fences.

There is exactly one bounty amount on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows require attacker-readable kill chains and replayable exploitation artefacts (Burp exports, parallel request harnesses, SQLi dump captures, SSO token forgeries, signing traces…).

These rows do not impose limits — they’re shorthand for tagging reports. Anything UTAR hosts, signs, proxies, parses, verifies, or integrates counts as bounty ground even if undocumented here. Treat “not listed” ≠ “out-of-scope”: default stance is open scope across UTAR’s digital perimeter.

Sandbox student portals, canary databases, Grafana for campus systems, Telegram/bot hooks for admin alerts, partner LMS or library integrations fronted by UTAR — all eligible when critical impact reproduces. Database access and admin panel compromise are the primary targets.

• Vanity subdomains CNAME’d into UTAR edge — show DNS/traffic proof in your write-up.
• Mobile app SDKs or widgets UTAR ships to students/staff
• Research grant management systems operated under utar.edu.my
• Internal database endpoints, phpMyAdmin, exposed DBMS ports, backup files
• IoT or smart-campus callbacks verified with UTAR-issued secrets

1. Prove exploitation success. Provide scripts, HARs, parallel request captures, or signing traces showing data/state impact — not paper analysis alone.
2. Number your hops. Session/API primitive → escalation → database/admin/payment integrity break.
3. Minimize real-user blast radius. Prefer mirrors, low-value accounts, and reversible payloads when demonstrating theft-class bugs.
4. Private coordination first. Use official intake on utar.edu.my before public threads.
5. Duplicate fairness. First qualifying PoC wins; followers close acknowledged-only.

Use the security / vulnerability disclosure contact published on https://utar.edu.my/ (security@utar.edu.my is a common guess — verify on the live site before emailing). Template below.

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — database/admin/student impact in one paragraph

# Severity self-classification → must map to UTAR critical definitions above

## Attack chain narrative (numbered, no gaps)
1. Preconditions (session, API key tier, endpoint, account ID)
2. Entry primitive — HTTP/WS line + signature headers
3. Pivot(s) → privilege/data/payment escalation
4. Final hop → DB exfil / admin takeover / payment diversion / infra takeover equivalent

## Successful exploitation evidence
• Scripted replay showing record/payment impact
• Paired HAR/PCAP demonstrating cross-user data access
• SQLi dump output or database connection proof
• Signing or token trace if SSO/crypto primitive involved

# Remediation suggestion (optional but appreciated)
• Short description of expected fix orientation

# Attachments (zipped, <10 MB, no malware)
- PoC script.py, capture.har, logs/

Pseudocode illustrating admin panel session replay leading to database access — meaningless without attaching HAR/logs proving an unauthorized request retrieves protected data inside utar.edu.my.

# BUGGY: admin panel trusts session cookie without IP/scope binding
import requests

BASE = "https://utar.edu.my/admin/api/v1"
SESSION = "eyJhbGciOiJIUzI1NiIs..."  # captured admin session

def export_students(db_table):
    resp = requests.get(
        f"{BASE}/export/{db_table}",
        headers={"Cookie": f"utar_admin_session={SESSION}"}
    )
    return resp.json()

# MISSING: server-side binding of session to IP, user-agent, or scope
# attacker replays stolen admin session → extracts database rows
for table in ["students", "staff", "payments"]:
    data = export_students(table)
    print(table, len(data), "records")