Security vulnerabilities identified in Lower Bavaria official website

A critical SQL injection vulnerability and a cross-site scripting (XSS) flaw were discovered on the official website of Lower Bavaria. The security flaws, reported by a researcher, potentially allowed attackers to gain complete access to the backend database and filesystem.

Initial attempts to coordinate a fix with the website owners met with resistance. The organization's IT department reportedly claimed the systems were secure, later stating that because the website was not hosted on their own servers, they did not face a problem. Following the report being escalated to the Data Protection Officer of Bavaria, the vulnerabilities were addressed and fixed after approximately two months.