White-Hat Hacker Schools Security Pro School
Summary: Security consultant Alex Holden found that (ISC)²'s checkout page listed his registration details in plaintext and let him renew his $85 CISSP membership by changing the amount in the URL to a negative number, producing a confirmation email without payment. (ISC)² Executive Director W. Hord Tipton said the flaw had been found in the organization's annual penetration tests but was wrongly flagged as non-exploitable, and the checkout URL now uses encrypted values.
What's compelling: About 2,000 security professionals register on the site each month to take the CISSP exam, and (ISC)² found no sign anyone else had exploited the weakness before Holden reported it.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026