Injection flaw in the legacy hosting control panel
Description
The penetration test showed that a form field in the legacy hosting control panel passes its input straight to the database. With a crafted value the tester read account records of other hosting customers. Few customers still use the panel, but the data is theirs.
Summary
On trackThis workflow is complete.
Completed
on
The form field now passes through a strict input filter, and the few customers still on the panel were told about the change. The panel stays on the decommissioning list.
Completed
on
The same crafted values from the penetration test were replayed against the panel and all were refused. The retest found nothing new.