View difference between Paste ID: yUFxs2J7 and 9VBiRpAR

-# Title: PowerSchool Mobile - Logging Sensitive Information
+# Title: Infinite Design - Cleartext Transmission of username and password
-# Application: PowerSchool Mobile
+# Application: Infinite Design
-# Version: 1.1.8
+# Version: 3.4.12
-# Software Link: https://play.google.com/store/apps/details?id=com.powerschool.portal
+# Software Link: https://play.google.com/store/apps/details?id=com.brakefield.idfree
-# Company: PowerSchool Group LLC
+# Company: Infinite Studio Mobile
-# Installs: 1,000,000+
+# Installs: 5,000,000+
-# Impact: Hackers can get username and password of the app by looking at the log
+# Impact: Anyone watching the network packet can obtain a username and password.
 # Category: Mobile Apps
-# Tested on: Android 8
+# Tested on : Android 9
 
 ---Description---
-PoweverSchool Mobile, the popular education app installed more than 1 million, logs username and password in Logcat during login step. So, hackers can obtain user password/ID of PowerSchool Mobile, simply looking at Logcat. Especially, in old Android versions prior to Android Jelly Bean, any app installed can access Logcat without any permission.
+Infinite Design, the popular Art app downloaded more than 5 millions, sends username and password via TCP without any encryption during login. So, anyone watching the network packet can obtain a username and password. It is critical, especially in mobile phones, because mobile phones are usually used in an insecure environment such as public WiFi.
 
 ---Vendor feedback---
-We have reported this issue to the vendor, and they will fixed this problem soon.
+After reporting, the vendor have quickly fixed this problem and released a new version.
 
 ---PoC---
-1. Try to login in PowerSchool, entering username and password.
+1. Try to login with Infinite Design, Android app.
     - Going to Settings
-2. Search password in the log
+    - Enter credentials. Fake information is enough for reproducing.
-  $ adb logcat | grep 'password'
+
-
+2. Sniffing network packet with any capturing tool.
-11857 12122 D SoapCall: loginToPublicPortal request xml <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www...<username><![CDATA[jaeho.lee@rice.edu]]></username><password><![CDATA[myPasswordHere]]></password.</loginToPublicPortal></soap:Body></soap:Envelope>
+   - the captured HTTP POST message contains user email and password.
 
   Hypertext Transfer Protocol
     POST /users/index.php HTTP/1.1\r\n
     Content-Type: application/x-www-form-urlencoded\r\n
     charset: utf-8\r\n
     Content-Length: 63\r\n
     User-Agent: Dalvik/2.1.0 (Linux; U; Android 9; ...)\r\n
     Host: www.seanbrakefield.com\r\n
     Connection: Keep-Alive\r\n
     Accept-Encoding: gzip\r\n
     \r\n
     [Full request URI: http://www.seanbrakefield.com/users/index.php]
     [HTTP request 1/1]
     [Response in frame: 662]
     File Data: 63 bytes
   HTML Form URL Encoded: application/x-www-form-urlencoded
     Form item: "tag" = "login"
     Form item: "email" = "jaeho.lee@rice.edu"
     Form item: "password" = "MyPasswordIsHere!"
 
 
 ---Reporter---
 Jaeho Lee(Jaeho.Lee@rice.edu)
 Rice Computer Security Lab
 Rice University