Bihar govt website left Aadhaar, pension data exposed — a 21-year-old student caught it
A Bihar government website had a major security flaw that left the data of millions of Indians exposed. The vulnerability was bad enough that anyone could have used it to pull sensitive information — Aadhaar numbers, pension details, government employee IDs, and more. A 21-year-old named Prashant Kumar spotted the flaw on the Bihar Mahadalit Vikas Mission (BMVM) website and brought it to a well-known publication.
The Bihar Mahadalit Vikas Mission (BMVM) website is an official Bihar government portal. It is used to access state government benefit programs. Consequently, if the site were compromised, a hacker could gain access to residents’ personal data.
To put the severity of such a breach into context, it is worth noting that the website hosted a database containing critical information. Prashant Kumar told a famous publication: “That data includes Aadhaar numbers, phone numbers, and PAN card details. Furthermore, for programs requiring a bank account, banking details—such as account numbers and IFSC codes—are also listed.”
Flaw in the Bihar website
Prashant Kumar explained that the flaw was related to an SQL injection vulnerability on the BMVM website’s password recovery page. This glitch allowed anyone to access the database, make modifications, copy information, or even delete data without needing to log in. Typically, websites perform two checks to prevent SQL injections: one on the client side (i.e., on the user’s device) and another on the server (the host site). However, in this instance, Prashant noted that the check was performed solely on the client side. He added, “This website only performs the check on the client side; it does not carry it out on the server side.”
According to Prashant, performing checks only on the client side makes the webpage more vulnerable. He explained, “If there is an option selected on my phone, we can deselect it; since I have the phone with me, we can alter its entire code and do anything.”
This meant that anyone could access the database using SQL code on the password recovery page, where personal data was originally supposed to be entered. Prashant noted, “We can input SQL code for any purpose: reading the database, modifying it, or even deleting it entirely.”
Furthermore, Prashant believes this vulnerability was so easy to exploit that anyone with basic SQL knowledge could have accessed the system. “Anyone who has studied SQL databases could have accessed the database by exploiting this flaw,” explained Prashant Kumar.
Prashant Kumar reported the vulnerability to CERT-In after discovering it. He was informed that the matter had been referred to the team responsible for the website. By the time of writing, the flaw had already been fixed.
What data was at risk of exposure?
According to Prashant, the database account used by the website had read access to 57 databases on its server. The database contained information on recruitment candidates—including Aadhaar and PAN details—and, in some cases, passwords stored in plain text. There were also records of applicants for driver training programs, including their addresses, Aadhaar details, and qualifications.
Furthermore, it was possible to obtain the login credentials of approximately 673 government officials, including district magistrates and Block Development Officers. This would allow anyone to access the website’s administrative dashboard using these official credentials. The database also housed extensive datasets regarding social welfare programs, such as pensions, land ownership records, the MGNREGA scheme, electoral roll data, and livelihood programs.
This is not the first time a student has detected serious flaws in an Indian government website. Earlier this year, 12th-grade students discovered significant security vulnerabilities on the CBSE website, sparking widespread outrage. At the same time, concerns regarding data leaks have been mounting. Recently, it was discovered that 1 TB of confidential data from the Bank of Baroda had leaked online and was available for free.