Vulnerability Severity Report Of World Flights Online Ltd

Introduction

This threat/vulnerability severity report has been prepared on the request of the CEO of World Flights Online Ltd. Due to the nature of the business large part of WFO Ltd.’s business is online. The sales staff who are distributed between 3 various locations throughout the UK use Web based application for flight bookings for clients. With this kind of business model and strong online presence It is essential that the website https://www.worldflights.com must be evaluated for the security of the application against best practice criteria and also to validate its security mechanisms and to identify application level vulnerabilities.

This report is based on web application focused penetration test. The purpose

Hackers continue to attack web-based applications as they often get direct access to back-end data such as customer databases.

Recent high-profile attacks have included Yahoo, TalkTalk, Sony Pictures among many others. The nature of cyber attacks is also changing as criminals target not only financial data but personal data as well for use in identity theft and confidential intelligence to carry out cyber espionage.

The website we have tested for this report have room for improvement. The web application seems to suffer from the most fundamental security flaws, and exploiting these vulnerabilities should be no big deal for even a novice hacker. The vulnerabilities found give hacker a chance to modify and even delete user accounts, to redirect users to malicious websites under the control of the hacker, and to list every user password.

Our findings confirm that these web application vulnerabilities are threat to organizations’ overall security, such as data loss or alteration, system down-time, loss of reputation and severe fines from the regulators

Vulnerabilities that have the potential to get command or administrative level access to the underlying operating system of the web server and its supporting database server, allowing an attacker to gain unauthorised access to the application and its resources, whilst permitting authenticated and authorised users of the application to elevate their privileges and attack other users of the system.

The web application allows raw SQL queries to be injected via users input fields. SQL injection happens when user input is not filtered for escape characters and its then passed into a SQL statement. Many functions within the application dynamically create SQL statements from user input and perform no validation on the user input before doing so.

Attacker can inject raw SQL statement that will modify the execution of the statements. This vulnerability allows an attacker read and writes access to all of the data stored within the database. An attacker could steal, modify or destroy any or all the data using SQL