Flaw in Columbia, S.C., website exposed city passwords

StateScoop: The official website of the city of Columbia, South Carolina, had a flaw in its search tool that allowed people to see passwords used to access municipal databases and email servers, an internet security researcher discovered this week.

Keyword searches for terms not found on the city’s website turned up a results page meant only for IT administrators that contained credentials that could’ve been used to access internal networks, steal sensitive resident and employee information, or commandeer the city government’s email system.

Read article