Student discovers critical security vulnerabilities in NASA and University of Melbourne

Muhammad Al Hindawi, a 12th-grade student and Quran memorizer from the Al Imam Ashim Islamic Boarding School in Makassar, Indonesia, has discovered critical security vulnerabilities in the systems of NASA and the University of Melbourne.

After studying cybersecurity independently for approximately four to five months, Hindawi identified two SQL Injection vulnerabilities within NASA's systems and one similar vulnerability at the University of Melbourne. He reported these findings through the official Vulnerability Disclosure Program (VDP) on the Bugcrowd platform.

His technical process involved using tools such as Subfinder for subdomain mapping and httpx to check response codes before identifying the specific SQL Injection vulnerabilities. Following his reports, NASA issued him a Letter of Recognition (LOR), and the University of Melbourne's Cyber Operations team validated his findings.