During the engagement, a total of 3 findings were identified against https://online.acmebank.example: 1 critical, 1 high and 1 low.
The most significant issue is SQL Injection in login parameter (Critical, CVSS 9.8), which should be remediated as a priority.
The overall risk to the application is assessed as Critical. Immediate remediation is strongly recommended before the application is exposed to untrusted users.
Detailed technical findings, evidence, and remediation guidance are provided in the following sections. All testing was performed with appropriate authorization.
| Severity | Count | CVSS Range |
|---|---|---|
| Critical | 1 | 9.0 – 10.0 |
| High | 1 | 7.0 – 8.9 |
| Medium | 0 | 4.0 – 6.9 |
| Low | 1 | 0.1 – 3.9 |
| Info | 0 | 0.0 |
| Step | Status |
|---|---|
| Reconnaissance & scope confirmation | Complete |
| Information gathering & technology fingerprinting | Complete |
| Configuration & deployment review | Complete |
| Authentication & session management testing | Complete |
| Authorization / access control testing | Complete |
| Input validation & injection testing (SQLi, XSS, SSTI, CMDi, ...) | Complete |
| CSRF / CORS / clickjacking / security headers | Complete |
| File upload & download handling | Complete |
| Business logic & abuse-case testing | Pending |
| Error handling & information disclosure | Pending |
| Client-side / supply-chain review (third-party JS, dependencies) | Pending |
| Retesting of confirmed findings | Pending |
| ID | Title | Severity | CVSS | Status |
|---|---|---|---|---|
| F-001 | SQL Injection in login parameter | Critical | 9.8 | open |
| F-002 | Broken Access Control — IDOR on account statements | High | 6.5 | open |
| F-003 | Security headers missing (CSP, HSTS, X-Frame-Options) | Low | 4.3 | open |
https://online.acmebank.example/login
username
POST
The username parameter of the login form is concatenated directly into a SQL query, allowing authentication bypass and full database extraction.
POST /login HTTP/1.1\nusername=' OR '1'='1'--&password=x\nHTTP/1.1 302 Found\nLocation: /dashboard
Full authentication bypass, complete disclosure of customer records, funds manipulation.
Use parameterized queries / prepared statements everywhere; validate input; apply least-privilege DB accounts.
https://online.acmebank.example/statements
account
GET
Account statement endpoint trusts a user-supplied account number without verifying ownership, exposing other customers' statements.
GET /statements?account=4102937 with a session for account 4102936 returned full statements.
Cross-account data exposure — sensitive financial records of any customer.
Enforce server-side object-level authorization on every resource access.
https://online.acmebank.example/
GET
No Content-Security-Policy, HSTS, or X-Frame-Options headers observed on any response.
curl -sI https://online.acmebank.example/ — no security headers present.
Increases the risk and impact of XSS, clickjacking, and protocol-downgrade attacks.
Set a strict CSP, HSTS (with preload), X-Frame-Options: DENY, and Referrer-Policy.
The engagement identified 3 finding(s). Findings should be tracked to closure with defined owners and target dates. High and critical findings should be remediated before the application is exposed to untrusted users.