Name, NRIC, Sex, School and Timetable of students were publicly available from e-Learning leader, Litespeed

During the height of the H1N1 crisis in Singapore, many schools turned to e-learning services to allow their quarantined students to continue their learning.

At the same time, we did a scan of the leading e-learning provider, Litespeed, and found a search function, which requires no authentication, that displays Name, NRIC, Sex, School and Timetable of students.

You can perform searches using substrings, so if you typed in "Tan", you will get all the students with "Tan" in their name

This leakage had since been closed, thanks to the prompt response from Litespeed.

We understand that this function was requested for by the schools, which obviously had not considered about the confidentiality of the students' private info.

Attached are 2 screenshots - one showing the search form and the form showing (sanitised) search results.


Do note that we are disclosing this leak after the H1N1 crisis has subsided so that Litespeed did not get distracted in their services during the critical period.