IRIS PAYE-Master password

At work we’re in the process of migrating data from IRIS PAYE-Master over to our Sage accounting package to standardize payroll across our different offices.

We called Sage asking if it was possible to import the data direct and were told that unfortunately that was not going to be possible.

After some investigation it turns out PAYE-Master stores its information in an access database (PM001.DTA).

Renaming PM001.DTA to PM001.MDB and opening in access prompted for a password, but not our PAYE-Master password. I assumed that the database password was going to be derived from our PAYE-Master password so called IRIS and asked them for it (telling them I was going to develop an in house application which interfaced with PAYE-Master).

IRIS, in no uncertain terms said that they could not give out the password as it was the same for all customers.

Hang on a moment, that means that assuming you can get access to the physical data (PM001.DTA) you could view all the payroll information in PAYE-Master if you know this password.

After some disassembly, the password to every PM001.DTA file is Ziueli. Sorry IRIS.

Comments

• Dan Meineck says:

  Ouch! Good find Dave – I wonder how they propose to lock down customer security now that this is public knowledge!

  Reply
• Aaron says:

  Genius, the same password for all customers? Plus everyone gets a copy of the file containing the secret. How long did they expect the password to remain a secret?

  Reply
• Dave says:

  Yep, every customers DTA file will be protected with that password. 10 minutes with .Net Reflector and every customer can find the password for themselves.

  The worst security issue I’ve seen in a long time!

  Reply
• Mukhtiar Singh says:

  Hi,

  We are a small accountancy practice and we are also going through a transfer of our payroll system from Iris paye master to Payroll manager from Moneysoft.

  After entering the password for the Iris dta file, how do you convert it into a csv file?

  We are really stuck because it will be very time consuming to enter all the details.

  Any help would be grately appreciated.

  Regards

  M Singh

  Reply
• Dave says:

  Hi Mukhtiar,

  The exact procedure varies depending on which version of access you use, and the format Moneysoft need the data to be in.

  I’d suggest you first of all remove the password from the database then use this:

  http://timothychenallen.blogspot.com/2007/08/vb-convert-any-access-table-to-csv.html

  Reply
• bob says:

  thanks

  but seems they put passwords on to stop people like Mukhtiar Singh
  going into the data base not having a clue a messing thing up just a thought

  Reply

Leave a Reply

Name (required)

Mail (will not be published) (required)

Website

Δ