Email address is the vulnerability
... If you display the ticket ID, what is to prevent someone else who happen to know your email address from opening a new ticket using your email (Get ticketID) and simply login to access all your ticket?? :
I have just tried this test:
1. Using an email address that has previously been entered into the system, I created a new ticket, with nearly completely different information for the other fields, including a different full name.
2. I submitted the form, and I received a brand new ticket number.
3. I used the same email address and the new ticket number to log into the system (via from the main page login, and also via the emailed url).
4. What I was presented with was a list of all the tickets opened with that email address, and I can read every one.
So - the problem is the bad guy getting a user's email address. Having an existing ticket number is irrelevant, because the bad guy can create a bogus new ticket, get a new ticket number, and use that to log in and see all the submitted tickets for that email address.
I do thank you for leading me to this realization. I'll try to implement some security to block this type of attack while a username/password scheme is being created.
