E@syfile log-in security flaw

[Dave A]

If your E@asyfile application is not up to date, here is how to enter the program without having to log in:

When you click on E@asyfile, you will get a notice to update.
Click Update
The next message tells you there is an update available - do you want to update.
Click No

The program will go to the Application home page and you can wander around as you please without having to log in!

Major security flaw in my opinion.

[AndyD]

Hmmm, any way around a login is a security flaw.

[Dave A]

Given the serious nature of this security flaw, I've been trying to find an email address to notify SARS. Thought I may as well point out the updated certificate information bug when submitting your EMP501 while I was about it.

Looks like I'm going to have to phone as I can't find an email address in the contact us section of Efiling or the SARS website.

[Slippy]

Well spotted. Their development and testing cycle has some serious flaws. I helped our bookkeeper with 3 updates/upgrades this year, and clearly none of them addressed this rather large issue.

[Dave A]

Well, I called and ended up sending an email to a supervisor at the PAYE call centre operation.

I did rather feel like I was calling from Mars - they seemed totally perplexed as to what they should do with the report.
Hopefully it will end up in the right hands...

[AndyD]

It's strange they don't have a report system in place for the website but I wouldn't hold your breath Dave. I don't see them being keen to go bug squishing on what's probably one of their busiest weeks of the year for their efiling website.