CRITICAL
SQL Injection in Search Parameter
The search parameter on /products is vulnerable to SQL injection. User input is concatenated directly into
the SQL query without parameterization, allowing attackers to extract or modify database contents.
Evidence
GET /products?search=' OR 1=1 -- returned 200 with all products
Where to fix:
Application Code
- Fix in your backend query logic (e.g., repository/DAO layer)
Use parameterized queries or an ORM. Never concatenate user input into SQL strings.
HIGH
Cross-Site Scripting (XSS) in Comment Field
The comment field on the product review page does not sanitize user input. A stored XSS payload persists
and executes for every user viewing the page, enabling session hijacking and data theft.
Evidence
Payload <script>alert(1)</script> stored and executed on /products/42/reviews
Where to fix:
Application Code
- Sanitize in your controller/template rendering layer
Sanitize all user input on the server side and encode output. Implement a Content-Security-Policy header.
HIGH
Missing Content-Security-Policy Header
The Content-Security-Policy (CSP) header is not set. Without CSP, the browser allows loading resources from
any origin, making XSS attacks significantly easier to exploit.
Where to fix:
Web Server Config
Load Balancer
- Add in Nginx/Apache config or CDN settings
Add a Content-Security-Policy header. Start with a restrictive policy and loosen as needed.
HIGH
Missing Strict-Transport-Security (HSTS)
The HSTS header is missing. Without it, users can be downgraded from HTTPS to HTTP via man-in-the-middle attacks,
exposing session cookies and sensitive data.
Where to fix:
Web Server Config
Load Balancer
- Add header in Nginx/Apache or AWS ALB/CloudFront
Add Strict-Transport-Security: max-age=31536000; includeSubDomains header.
MEDIUM
Cookie Missing HttpOnly Flag
The session cookie SESSIONID does not have the HttpOnly flag set.
JavaScript can read this cookie, making it vulnerable to theft via XSS attacks.
Where to fix:
Application Code
Web Server Config
- Set in session config or server cookie settings
Add the HttpOnly flag to all session cookies in your server configuration.
HIGH
Open Redirect in Login Return URL
The returnTo parameter on /login accepts arbitrary external URLs.
Attackers can craft links that redirect users to phishing sites after authentication.
Evidence
GET /login?returnTo=https://evil.com → 302 redirect to https://evil.com after login
Where to fix:
Application Code
- Validate redirect URLs against a whitelist of allowed domains
Only allow redirects to relative paths or a whitelist of trusted domains. Reject absolute URLs pointing to external hosts.
MEDIUM
Missing X-Frame-Options Header
The site does not set X-Frame-Options or CSP frame-ancestors directive.
This allows the site to be embedded in iframes on any domain, enabling clickjacking attacks.
Where to fix:
Web Server Config
Load Balancer
- Add header in Nginx/Apache or CDN settings
Add X-Frame-Options: DENY or use CSP frame-ancestors 'none'.
MEDIUM
Cookie Missing Secure Flag
The session cookie SESSIONID does not have the Secure attribute.
The cookie can be transmitted over unencrypted HTTP connections, exposing it to network sniffing.
Where to fix:
Application Code
Web Server Config
- Set in session config or server cookie settings
Add the Secure flag to all cookies, especially session cookies, so they are only sent over HTTPS.
MEDIUM
CORS Allows Wildcard Origin
The API responds with Access-Control-Allow-Origin: *, allowing any website to make
cross-origin requests. Combined with credentials, this can leak sensitive data to malicious sites.
Evidence
Response header: Access-Control-Allow-Origin: * on /api/user/profile
Where to fix:
Application Code
Web Server Config
- Restrict to specific trusted domains in CORS config
Replace wildcard with an explicit whitelist of allowed origins. Never use * with credentialed requests.
LOW
Server Version Disclosure
Response headers reveal the web server type and version (Server: nginx/1.24.0,
X-Powered-By: Express). This helps attackers identify known vulnerabilities for specific versions.
Evidence
Server: nginx/1.24.0 • X-Powered-By: Express
Where to fix:
Web Server Config
- Remove or suppress version headers in Nginx/Apache config
Set server_tokens off in Nginx or ServerTokens Prod in Apache. Remove X-Powered-By header.
LOW
Missing Subresource Integrity (SRI)
External scripts loaded from CDNs (e.g., jQuery, Bootstrap) do not have integrity attributes.
If the CDN is compromised, malicious scripts could execute on your site without detection.
Where to fix:
Application Code
- Add integrity hash to all external script/link tags
Add integrity="sha384-..." and crossorigin="anonymous" to all CDN-loaded resources.
LOW
Domain Expires in 67 Days
The domain example-store.com expires on Mar 23, 2026. While not urgent, consider enabling auto-renewal if not already set.
Where to fix:
Domain Registrar
- Log in to your registrar and enable auto-renewal
Enable auto-renewal with your registrar to ensure continuous domain ownership.
+ 9 more findings in full report