Hey tennis enthusiasts, have you heard the latest news about a security vulnerability in MyCourts? This popular tennis court booking and league management platform used by clubs across the UK recently faced a serious flaw that could have put user accounts at risk.
So, What Went Down?
Security guru William Fieldhouse from Aardwolf Security uncovered a sneaky XSS vulnerability in MyCourts. Surprisingly, the vulnerability lurked in an unexpected place: the LTA (Lawn Tennis Association) number field within user profiles.
This vulnerability was no joke, scoring a 7.3 on the CVSS scale, marking it as high severity. Although the flaw has been fixed now, it’s a stark reminder of the importance of web application penetration testing.
How Did the Attack Play Out?
The vulnerability exploited a common web security pitfall: insufficient input validation. When users innocently entered their LTA number in their profiles, the application failed to properly vet or clean the data before storing it.
This created an opening for attackers to inject malicious JavaScript code into the field. When other users innocently checked out the attacker’s profile, this code would trigger in their browsers, setting off a chain reaction.
- The attacker sets up a profile with malicious code
- Legitimate users view the attacker’s profile
- The malicious JavaScript executes in the victim’s browser
- The script snags the victim’s session cookie
- The attacker waltzes into the victim’s account using the stolen session
What made this even scarier was that MyCourts session cookies lacked the HttpOnly protection flag, allowing JavaScript to access them and enabling the session hijacking.
What’s the Real-World Risk?
This wasn’t just a hypothetical scenario. The implications were serious:
Session Hijacking: Attackers could nab admin sessions, gaining full control over club management.
Account Takeover: With stolen sessions, attackers could mess with bookings, user info, or financial data.
Persistent Access: Stolen session tokens could be reused for long-term unauthorized access.
Data Breach: Access to sensitive user data, bookings, and potentially payment details.
The Silver Lining
HBI Consulting Ltd, the brains behind MyCourts, sprang into action upon learning about the vulnerability. The flaw was reported and swiftly fixed in the same month, thanks to their proactive approach to security.
Aardwolf Security verified the remediation, ensuring that the stored XSS vulnerability is now a thing of the past.
What Should Tennis Clubs Do?
If your club uses MyCourts, here’s what you should do:
Check Your Version: Make sure you’re on the August 2025 release or later. Contact HBI Consulting Ltd for confirmation.
Monitor User Activity: Look out for any suspicious behavior during the vulnerability period.
Enhance Security Measures: Use this as a chance to beef up your security and keep all apps up to date.
Web Security Lessons Learned
This incident sheds light on key security principles:
Validate Inputs: Even mundane fields need proper validation. Trust nothing!
Layered Security: Multiple safeguards are a must. Setting the HttpOnly flag on cookies could have lessened the impact of this vulnerability.
Encode Outputs: Always encode user data before displaying it on web pages.
Regular Security Checks: Stay vigilant with routine security assessments and code reviews.
Why Responsible Disclosure Matters
This case underscores the importance of responsible disclosure. By working together with the vendor, the researcher ensured a fix was in place before going public, safeguarding users while highlighting the issue.
Thanks to this collaborative effort, MyCourts users now enjoy enhanced security.
Looking Ahead
Even though this vulnerability is now history, it’s a wakeup call for ongoing web security. Prioritize security at every stage and conduct thorough testing to nip vulnerabilities in the bud.
The swift response by HBI Consulting Ltd and the diligent work by Aardwolf Security showcase how teamwork can bolster user protection and software security.
Source: For detailed info, check out the original vulnerability disclosure.
About the Discoverer: William Fieldhouse of Aardwolf Security unearthed this vulnerability during research in August 2025.
sentence: The cat is sleeping peacefully on the windowsill.
Rewritten: Peacefully sleeping on the windowsill is the cat.
