A flaw in North Carolina’s online jury-service exemption form exposed documents uploaded by members of the public, according to WBTV. Zach Duda discovered the issue after submitting his father’s death certificate through the form and noticing that the document’s URL appeared in an email confirmation. By changing a number in the web address, he said, he could access files uploaded by other applicants.
WBTV reportedly used the same method and found dozens of documents, including driving licences, Social Security numbers, employment information and medical records. The material also included a rape incident report naming the victim. The report indicates that the exposure resulted from predictable document URLs and says the issue could potentially have been automated, but it does not establish that an automated attack occurred or quantify the total number of affected people.
Duda said he reported the vulnerability through an online bug-reporting channel for the North Carolina Administrative Office of the Courts, but had received no response at the time of the report. The supplied material does not state whether the court system fixed the flaw, removed the exposed files or notified affected individuals.