solarforceflashlight-sales.com - member list accessible by public

Lets see how long it takes for them to fix it.

I have emailed them with a link to this thread. Lets see if we get a response.

|( A least they responded quickly, allthough the error is very serious.
Pardon my tone of language on deleted post.

Notified PayPal about it too

Deleted

Well that sucks.

Edit: Found myself, and a couple of others I know by name. Gonna see if I can delete my account now…
Edit2: Couldn’t delete, so changed my name to initials. (tip: log out and back in to confirm the change).

Edit3: I recommend everyone do this to ensure their real name stops being crawled in association with their PP account email.

I did a check like that before too with my first name + surname and then with my surname.

My surname is a common one in the muslim world so nothing gets related to me. With my complete name, I was finding it a bit disturbing that my every likes and talk in public groups in facebook was being available on google. So I just changed my real name to a pseudo name on facebook. Problem solved.

I stopped buying from IOS after its security blunder. I will stop buying from SF Sales now as well.

Leaving the customer list visible like that is a massive snafu. SMH.

Its an Admin page of some kind. Sadly changing your details doesnt seem to work, not immediately at least. I tried it a couple of hours ago, cleared my cache, still comes up with my original reg name. Might work eventually though so its still worth trying it.

Lucky for me, I never use my full name anyway.

I'm thinking the admin forgot to tell Google not to cache the page, so Google has cached a page meant to be accessible only by admin rights.

Its accessible directly from solarforceflashlight-sales.com. Its not just a google cache copy.

Seems to be fixed.
~ edit ~
(link deleted) Might still be vulnerable.

Still coming up on Google though

Its going to come up on google until they crawl solarforceflashlight-sales.com again.

Free DIY website design?

http://www.webs.com/

They have about 564*15 = 8460 buyers :slight_smile:

Don't spread the word...let them solve this asap before more people can "use" this..

Please dont post on other forums yet.

I hate to make accounts with these stupid vendors .I just pay with paypal and avoid their silly promotions ,points etc . the fact they ask for your phone number is just retarded .i've never given the correct number yet ... Welcome to the internet .

Wrong.

I found myself on their list, and without being logged in in any way, I am able to see the name, email, physical address, phone number, and full purchase history of every user on the list. It looks like I can also edit their accounts, though I didn’t try to save any changes. It seems that other admin functions are available too, simply by following the link from google.

For that matter, it seems I have access to edit their product listings, authorized dealer lists, … Hey, looks like someone else has already edited that; they added an entry which is an all-caps profane insult.

Hmm. Looking around further, it seems others have probably noticed too. Check out their news page:

I think it’s safe to say it’s totally broken and they need to fix it ASAP.

Edit: When I checked the news page again, the article asking their admin to fix the admin access was gone. Looks like someone there is probably working on it.

Guess it’s good I couldn’t buy direct from them, ended up buying from their Ebay store.