1444_CT_IAP491_01_Slides_Capstone_Project.pptx

1444_CT_IAP491_01_Slides_Capstone_Project.pptx

• 1.
  CAPSTONE PROJECT PRESENTATION Analysisand Security Assessment of Online Event Management Systems Presented By: IAP491_01 Supervisor Luong Hoang Huong Page 1 of 78
• 2.
  OUR TEAM PHAM TRONGTINH TRINH PHUONG HUY MEMBER MEMBER VO HOANG PHUC UNG NHAT TIEN NGUYEN PHUOC THINH LEADER MEMBER MEMBER Page 2 of 78
• 3.
  TABLE OF CONTENT 1.PROJECT INTRODUCTION 2. PROJECT MANAGEMENT PLAN 3. RISK ASSESSMENT 4. RISK MANAGEMENT PLAN 5. Demo Page 3 of 78 6. Q&A
• 4.
  1. PROJECT INTRODUCTION IAP491_01 August30, 2025 Page 4 of 78
• 5.
  OVERVIEW EVENT MANAGEMENT APPSLIKE THE FPT EVENT MANAGEMENT SYSTEM HANDLE SENSITIVE DATA AND IOT CONTROLS, MAKING SECURITY VITAL. WITH RISKS FROM BOTH WEB AND MOBILE PLATFORMS, THIS PROJECT APPLIES TAILORED PENETRATION TESTS AND CHECKLISTS TO FIND AND FIX VULNERABILITIES BEFORE EXPLOITATION. 1. PROJECT INTRODUCTION Page 5 of 78
• 6.
  1. PROJECT INTRODUCTION IntroductionInformation System Event Management System (EMS) THE EVENT MANAGEMENT SYSTEM (EMS) MANAGES EVENTS ACROSS FPT UNIVERSITY WITH FOUR ROLES: STUDENT, ORGANIZER, MANAGER, AND ADMINISTRATOR. ITS MOBILE APP SUPPORTS EVENT MANAGEMENT, REGISTRATION, AND SMARTTV INTEGRATION FOR PRESENTATIONS. Page 6 of 78
• 7.
  Use Cases of Event Managemen tSystem(1) Page 7 of 78
• 8.
  Use Cases of Event Management System(2) Page8 of 78
• 9.
  Use Cases of Event Management System(3) Page9 of 78
• 10.
  1. PROJECT INTRODUCTION CONFIDENTIALITY Protectssensitive data like attendee names, event details, and feedback; ensures only authorized access. INTEGRITY Maintains accuracy and consistency of event data, ensuring reliable reports and decision-making. AVAILABILITY Ensures EMS is operational with minimal downtime, enabling smooth schedules, updates, and live interactions. C-I-A IN EMS Page 10 of 78
• 11.
  1. PROJECT INTRODUCTION DeploymentArchitecture Deployment Diagram Page 11 of 78
• 12.
  WEB APPLICATION MOBILEAPPLICATION METHODOLOGY MULTI-ROLE ATTACK SIMULATION Pentesting using OWASP- based methods for common vulnerabilities (Injection, XSS, IDOR, SSRF, Security Misconfiguration). Source code review, insecure data/API checks, and OWASP Mobile Top 10 testing. Black-box & Gray-box testing with simulated accounts. Testing Anonymous and Authenticated roles (Student, Organizer, Manager, Admin, Super roles) for access control, privilege escalation, logic flaws, and insecure communication. PROJECT SCOPE 1. PROJECT INTRODUCTION The thesis evaluates and enhances the security of FPT University’s Event Management System (EMS) on Web and Mobile platforms through multi-layered security assessments. OUTCOME Tailored pentest framework, detailed vulnerability report, and prioritized remediation strategies. Page 12 of 78
• 13.
  2. Project Management Plan IAP491_01August 30, 2025 Page 13 of 78
• 14.
  OVERVIEW Project management isthe key to successfully implementing FPT Event Management Application penetration testing. 2. PROJECT MANAGEMENT PLAN Using structured project management principles enables systematic planning, efficient resource use, risk mitigation, and quality assurance in penetration testing for FPT’s web and Android event management application Page 14 of 78
• 15.
  Project Management Framework Page15 of 78
• 16.
  Scope & Estimation WORK BREAKDOWN STRUCTURE Page16 of 78
• 17.
  ROLES AND RESPONSIBILITIES TeamRoles Representation Diagram Page 17 of 78
• 18.
  PROJECT RISK MANAGEMENT RISK MANAGEMENT Page18 of 78
• 19.
  TOOLING Page 19 of78
• 20.
  PROJECT TIMELINE MILESTONE PLANCHART Page 20 of 78
• 21.
  PROJECT TIMELINE GANTT CHART Page21 of 78
• 22.
  PROJECT TIMELINE CRITICAL PATH Page22 of 78
• 23.
  QUALITY ASSURANCE PROCESS WEB/ MOBILE APPLICATION TESTING AND REPORT PROCESS Page 23 of 78
• 24.
  3. RISK ASSESSMENT(1) IAP491_01 August 30, 2025 Page 24 of 78
• 25.
  THE NEED OFASSESSMENT IS THE REQUIREMENT OF A KEY PROCESS THAT ORGANIZATIONS NEED TO UNDERTAKE TO IDENTIFY AND MITIGATE POTENTIAL RISKS, ESPECIALLY DURING THE DEVELOPMENT PERIOD. 3. RISK ASSESSMENT Page 25 of 78
• 26.
  ASSETS IDENTIFICATION Page 26of 78 Attribute Details Asset Type Credentials Probability Factors Weak or reused passwords- Lack of multi- factor authentication- Poor session management or insecure credential storage/transmission- Poor role-based access control, enabling privilege escalation Probability Medium Impact Factors Unauthorized access to sensitive event and user data- Full system control if Administrator account compromised- Spoofing, privacy violations, and data integrity issues for other roles- Reputational damage, privacy breaches, regulatory issues, event disruption Impact High Attribute Details Asset Type Penetration Testing Resources Probability Factors Insecure storage (unencrypted files, exposed GitHub repos) Sharing over insecure channels Use of shared testing environments or cloud storage Probability Medium Impact Factors - Exposure of vulnerabilities before fixes - Use of stolen payloads to attack live systems - Loss of confidentiality of sensitive test results - Violation of responsible disclosure policies - Reputational, legal, and contractual risks Impact Critical ${pageNumberOfTotal}
• 27.
  INFORMATION ASSET CLASSIFICATION Page27 of 78 Attribute Details Asset Type Application Source Code Probability Factors - Public or misconfigured version control systems - Source files left on exposed servers or shared machines - Leaks via unsecured cloud sharing or email - Improper access controls on repositories - Lack of obfuscation in mobile apps Probability Low Impact Factors - Discovery of vulnerabilities before fixes - Theft of proprietary logic and algorithms - Exposure of hardcoded secrets - Facilitation of reverse-engineering - Intellectual property theft - Legal liabilities - Reputational damage and customer trust loss Impact High Attribute Details Asset Type Display Devices Probability Factors - Outdated firmware - Lack of network segmentation - Unchanged default credentials - Unpatched vulnerabilities - Open remote ports Probability Low Impact Factors - Foothold into internal networks - Unauthorized content injection - Covert surveillance via embedded hardware - Persistent backdoors resistant to reboot cleanup Impact Medium
• 28.
  LOGICAL ARCHITECTURE Page 28of 78
• 29.
  THREAT IDENTIFICATION Page 29of 78 No Threats 1 Phishing Attacks 2 Malware / Ransomware 3 Insider Threats 4 Denial-of-Service (DoS) 5 Natural Disasters 6 Third-Party Component Exploits 7 Zero-Day Exploits
• 30.
  VULNERABILITY IDENTIFICATION Page 30of 78 No Vulnerabilities 1 Cross-Site Scripting[12] (WSTG-INPV-02) 2 Insecure Direct Object References[13] (WSTG-INPV-02) 3 Webpage Content for Information Leakage[14] (WSTG-INFO-05) 4 Cross-site Request Forgery[15] (WSTG-SESS-05) 5 Business Logic[16] (WSTG-BUSL-01) 6 Stack trace[17] (WSTG-ERRH-02) 7 Test Upload of Unexpected File Types[18] (WSTG-BUSL-08)
• 31.
  IMPACT ASSESSMENT Page 31of 78 No Threats / Vulnerabilities Impact 1 Malware and Ransomware Significant Severity 2 Denial of Service (DDoS) Attacks Significant Severity 3 Insider Threats Catastrophic Severity 4 Phishing Attacks Major Severity 5 Natural Disasters Catastrophic Severity 6 Zero-day exploit Catastrophic Severity 7 Third-Party Component Exploits Major Severity No Threats / Vulnerabilities Impact 8 Cross-Site Scripting (XSS) (WSTG- INPV-02) Significant Severity 9 Insecure Direct Object References (IDOR) (WSTG-INPV-02) Major Severity 10 Webpage Content for Information Leakage (WSTG-INFO-05) Minor Severity 11 Cross-Site Request Forgery (CSRF) (WSTG-SESS-05) Major Severity 12 Business Logic Flaws (WSTG-BUSL- 01) Major Severity 13 Stack Trace Disclosure (WSTG- ERRH-02) Minor Severity 14 Upload of Unexpected File Types (WSTG-BUSL-08) Major Severity
• 32.
  LIKELIHOOD ASSESSMENT Page 32of 78 No Threat / Vulnerability Likelihood Level 1 Malware and Ransomware Likely 2 Distributed Denial of Service (DDoS) Possible 3 Insider Threats Unlikely 4 Phishing Attacks Almost Certain 5 Natural Disasters Rare 6 Zero-day exploits Rare 7 Third-Party Component Exploits Likely 8 Cross-Site Scripting (XSS) Likely 9 Insecure Direct Object References (IDOR) Likely 10 Information Leakage (WSTG-INFO- 05) Possible 11 Cross-Site Request Forgery (CSRF) Possible 12 Business Logic Flaws Possible 13 Stack Trace Disclosure Possible 14 Unexpected File Upload (WSTG- BUSL-08) Likely
• 33.
  RISK LEVEL MATRIX Page33 of 78 Likelihood Severity Catastrophic-5 Major-4 Significant-3 Minor-2 Insignificant-1 Almost Certain-5 Very High(25) Very High(20) Very High(15) High(10) Medium(5) Likely-4 Very High(20) Very High(16) High(12) Medium(8) Low(4) Possible-3 Very High(15) High(12) Medium(9) Medium(6) Low(3) Unlikely-2 High(10) Medium(8) Medium(6) Low(4) Very Low(2) Rare-1 Medium(5) Low(4) Low(3) Very Low(2) Very Low(1)
• 34.
  4. RISK ASSESSMENT(2) IAP491_01 August 30, 2025 Page 34 of 78
• 35.
  Information Gathering Asset Identification & Classification RiskIdentification Risk Analysis Control Identification & Assessment Risk Controlling & Monitoring Final Risk Rating RISK ASSESSMENT FLOW Risk Assessment Flow Page 35 of 78
• 36.
  INFORMATION GATHERING Archive Mining& Operator Interview (OSINT in Internal Context) Page 36 of 78
• 37.
  INFORMATION GATHERING Active Network& Service Enumeration Page 37 of 78
• 38.
  INFORMATION GATHERING Web &Application Fingerprinting Page 38 of 78
• 39.
  STANDARDS AND METHODSUSED Threat Modeling & Analysis STRIDE – 6 categories of security threats PASTA – 7-step attack simulation & threat analysis Page 39 of 78 Applied Standards ISO/IEC 27001 – Information security management framework NIST SP 800-30 – Structured risk assessment methodology OWASP Testing Guide & Top 10 – Web application security checklist OWASP MASVS – Mobile application security framework Vulnerability Scoring CVSS v3.1 – Base, Temporal, Environmental scores
• 40.
  ASSET IDENTIFICATION Page 40of 78
• 41.
  ASSET IDENTIFICATION Technical Infrastructure– 4-Tier Architecture Database Layer SQL Server: structured data (users, events, logs) Firebase: real-time push notifications & updates Presentation Layer (Client Layer) Web interface (Chrome, Safari) + Mobile app Google Sign-In, event view, registration, QR check-in, e- tickets Web Server Layer Windows Server + IIS 10.0 Enforces SSL, access control Hosts Website Module (browser interface) Hosts API Module (mobile app requests, real-time ops) Web Application Layer ASP.NET business logic User roles, event rules, data updates Integration with FAP API Page 41 of 78
• 42.
  ASSET CLASSIFICATION Page 42of 78
• 43.
  RISK IDENTIFICATION Classification ofthreat object List of threat events Relationship between threat object vs asset Page 43 of 78
• 44.
  RISK IDENTIFICATION Relationship betweenthreat object vs threat event Page 44 of 78
• 45.
  Stored Cross-Site Scripting(XSS) in CreateEvent via DescriptionHtml Parameter Business Logic Data Validation in Event Rejection RISK IDENTIFICATION Vulnerable identification Insecure direct object references - Student/UpdateFeedback and Student/DeleteFeedback Page 45 of 78 No Vulnerability Name 1 Cross-Site Scripting 2 Cross-site Request Forgery 3 Insecure Direct Object References 4 Cross-site Request Forgery 5 Insecure Direct Object References 6 Cross-site Request Forgery 7 Insecure Direct Object References 8 Cross-site Request Forgery 9 Cross-site Request Forgery 10 Insecure Direct Object References 11 Business Logic Data Validation 12 Testing for Exposed Session Variables 13 Stack Trace Disclosure 14 Test Upload of Unexpected File Types 15 Shortname Enumeration in IIS
• 46.
  RISK RATING Threat ActorCapability Assessment Vulnerability Characteristics Assessment Likelihood Assessment Page 46 of 78
• 47.
  RISK RATING Impact AssessmentTechnical Impact Assessment Business Impact Assessment Page 47 of 78
• 48.
  RISK RATING Risk ScoreInterpretation Risk Score Severity Matrix Likelihood scoring table Impact scoring table Page 48 of 78
• 49.
  RISK RATING Risk Rating Details Testingfor Stored Cross-Site Scripting (XSS) in CreateEvent via DescriptionHtml Parameter Risk Likelihood Assessment Table of vulnerability Likelihood Score = (4 + 7 + 8 + 7 + 8 + 9 + 7 + 3) / 8 = 53 / 8 = 6.625 (High Likelihood) Page 49 of 78 Factor Score Rationale Threat Agent Factors Skill Level 4 Requires knowledge of XSS payload crafting and targeting rendered fields. Motive 7 High incentive to escalate privileges or steal session tokens. Opportunity 8 Any Organizer can inject a payload; stored XSS increases the chance of hitting privileged users. Size 7 Many potential attackers if the Organizer role is common across users. Vulnerability Factors Ease of Discovery 8 Easily identifiable through testing WYSIWYG/HTML input fields. Ease of Exploit 9 Once payload is stored, it auto-executes on page load for others. Awareness 7 XSS is well-known and documented in OWASP Top 10. Intrusion Detection 3 XSS may silently exfiltrate data or perform actions without detection.
• 50.
  RISK RATING Risk Rating Details Testingfor Stored Cross-Site Scripting (XSS) in CreateEvent via DescriptionHtml Parameter Risk Impact Assessment Table of vulnerability Impact Score = (6 + 8 + 4 + 7 + 5 + 6 + 5 + 6) / 8 = 47 / 8 = 5.875 → (Medium Impact) Page 50 of 78 Factor Score Rationale Technical Impact Loss of Confidentiality 6 Attacker can steal session cookies, CSRF tokens, and sensitive user data. Loss of Integrity 8 Attacker can forge requests, modify victim data, or create unauthorized actions. Loss of Availability 4 Indirect DoS possible if malicious content disrupts rendering or logic. Loss of Accountability 7 Attacker can act on behalf of other users without traceability. Business Impact Financial Damage 5 Potential indirect damage if used for fraud or service abuse. Reputation Damage 6 Trust in the system is reduced if users see malicious or hijacked pages. Non-Compliance 5 Violates data protection and input handling policies. Privacy Violation 6 Sensitive information can be exfiltrated via JavaScript (e.g., names, email).
• 51.
  RISK RATING Risk Rating Details Testingfor Stored Cross-Site Scripting (XSS) in CreateEvent via DescriptionHtml Parameter Risk Score = Likelihood × Impact = 6.625 × 5.875 = 38.92 OWASP Severity table of vulnerability Page 51 of 78 Likelihood Impact Severity High (6.625) Medium (5.875) High
• 52.
  SUMMARY FINDINGS Page 52of 78 No Vulnerability Name OTG Affected Host/Path Risk Risk Score 1 Cross-Site Scripting WSTG-INPV-02 https://googleauthensite03.fpt.edu.vn:93/Organizer/CreateEvent (POST: DescriptionHtml) High 38.92 2 Cross-site Request Forgery WSTG-SESS-05 https://googleauthensite03.fpt.edu.vn:93/Admin/DeleteBuilding/{building id} High 33 3 Insecure Direct Object References WSTG-ATHZ-04 https://googleauthensite03.fpt.edu.vn:93/Student/UpdateFeedback (POST: UserId,EventId,Value,CreatedDate,FeedbackContent) https://googleauthensite03.fpt.edu.vn:93/Student/DeleteFeedback (POST: UserId,EventId) High 31.25 4 Cross-site Request Forgery WSTG-SESS-05 https://googleauthensite03.fpt.edu.vn:93/Manager/DeleteGroup/{group id} Medium 28.2 5 Insecure Direct Object References WSTG-ATHZ-04 https://googleauthensite03.fpt.edu.vn:93/Home/GetFeedback (POST: eventId) Medium 27.31 6 Cross-site Request Forgery WSTG-SESS-05 https://googleauthensite03.fpt.edu.vn:93/Manager/DeleteCategory/{category id} Medium 26.8 7 Insecure Direct Object References WSTG-ATHZ-04 https://googleauthensite03.fpt.edu.vn:93/Organizer/CreateEvent (POST: Campus) Medium 24.06 8 Cross-site Request Forgery WSTG-SESS-05 https://googleauthensite03.fpt.edu.vn:93/Manager/AcceptEvent/{event id} Medium 24.06 9 Cross-site Request Forgery WSTG-SESS-05 https://googleauthensite03.fpt.edu.vn:93/Manager/RejectReportedEvent (POST:eventId) Medium 20.625 10 Insecure Direct Object References WSTG-ATHZ-04 https://googleauthensite03.fpt.edu.vn:93/api/smartTv/insertSmartTv Medium 20.19 11 Business Logic Data Validation WSTG-BUSL-01 https://googleauthensite03.fpt.edu.vn:93/Manager/RejectReportedEvent (POST:eventId) Medium 19.66 12 Testing for Exposed Session Variables WSTG-SESS-04 https://googleauthensite03.fpt.edu.vn:93/api/auth/smartTv/getTvAccessToken? idGoogleToken= Low 14.375 13 Stack Trace Disclosure WSTG-ERRH-02 https://googleauthensite03.fpt.edu.vn:93/ Low 6.3 14 Test Upload of Unexpected File Types WSTG-BUSL-08 https://googleauthensite03.fpt.edu.vn:93/Home/ManageProfile Low 6.09 15 Shortname Enumeration in IIS WSTG-INFO-07 https://googleauthensite03.fpt.edu.vn:93/ Low 4.64
• 53.
  5. RISK MANAGEMENT PLAN IAP491_01August 30, 2025 Page 53 of 78
• 54.
  Risk Treatment Measure Prioritization Phase 2 Implementation and Monitoring 1.Apply Risk Treatments 2. Monitoring and Review 3. Long-term security Phase 3 Communication and Consultation 1. Stakeholder Communication 2. Feedback and Documentation Phase 4 Risk assessment 1. Risk identification 2. Risk Analysis 3. Risk Evaluation Phase 1 RISK MANAGEMENT PROCESS AND PHASE Page 54 of 78
• 55.
  RISK MANAGEMENT PROCESSAND PHASE Page 55 of 78
• 56.
  Objectives of Risk Managemen t Plan(RMP) Identify and Prioritize Security Risks Identify and Prioritize Security Risks Identify and Prioritize Security Risks Identify and Prioritize Security Risks Identify and Prioritize Security Risks Page 56 of 78
• 57.
  Threat Modeling Continuous Monitoring Risk Appetite& Tolerance Risk Register & Heat Map Risk Managemen t Approach Qualitative & Quantitative Analysis Cost–Benefit Analysis (CBA) & BCR Ratio Page 57 of 78
• 58.
  𝑹𝒊𝒔𝒌 = 𝑳𝒊𝒌𝒆𝒍𝒊𝒉𝒐𝒐𝒅𝒙 𝑰𝒎𝒑𝒂𝒄𝒕 Risk Likelihoo d Impac t QUALITATIVE & QUANTITATIVE ANALYSIS Page 58 of 78
• 59.
  COST–BENEFIT ANALYSIS (CBA)& BCR RATIO 𝑩𝑪𝑹 = ÷ 𝑻𝒐𝒕𝒂𝒍 𝑩𝒆𝒏𝒆𝒇𝒊𝒕 𝑻𝒐𝒕𝒂𝒍 𝑪𝒐𝒔𝒕 Page 59 of 78
• 60.
  RISK REGISTER &HEAT MAP Page 60 of 78
• 61.
  Define the Objectives Definethe Technical Scope Decompose the Application Analyze the Threats Vulnerability Analysis Attack Analysis (Simulation) Risk and Impact Analysis STRID E Threat Modeling PASTA Page 61 of 78
• 62.
  RISK APPETITE &TOLERANCE Page 62 of 78 Risk Value (VND) Response Action Example < 30,000,000 VND Accept and monitor UI bug with no impact on core system logic 30,000,000 – 50,000,000 VND Mitigate within 30 days SQL injection o > 50,000,000 VND Immediate action; escalate to management Student data leakage impacting the university’s reputation
• 63.
  Key Risk Indicators(KRIs) Automated scanningtools Regular review cycles CONTINUOUS MONITORING Page 63 of 78
• 64.
  Risk Management Implementatio n Process Framing Risk Framing Risk Monitorin g Risk Assessin gRisk Respondin gto Risk Page 64 of 78
• 65.
  Risk Handling Planning Overview of RiskHandling Planning Risk Treatment Strategies Benefits of Structured Risk Handling RISK HANDLING PLANNING AND IMPLEMENTATION Page 65 of 78
• 66.
  RISK HANDLING IMPLEMENTATION Cross-siteRequest Forgery(CSRF) Insecure Direct Object Reference(IDO R) Cross-site Scripting(XS S) Page 66 of 78
• 67.
  Include @Html.AntiForgeryToken() withinthe form Adding [ValidateAntiForgeryToken] to controller Cross-site Request Forgery(CSRF) RISK HANDLING IMPLEMENTATION Page 67 of 78
• 68.
  Cross-Site Scripting (XSS) • HTMLSanitization • Contextual Output Encoding • Content Security Policy (CSP) • Restrict Input to Markdown or Whitelisted HTML • Ownership Verification • Remove UserId from Client Input • Centralized Authorization Checks RISK HANDLING IMPLEMENTATION Insecure Direct Object Reference(IDOR) Page 68 of 78
• 69.
  RISK MANAGEMENT PROCESSAND PHASE Page 69 of 78 Measure Vulnerability Scope BCR Output Encoding (Html.Encode) Stored XSS – DescriptionHtml 5 Event Status Validation GetFeedback – unauthorized feedback 4.5 Remove UserId from Client Input Feedback endpoints (IDOR) 4 Restrict Client-Side Campus Input Organizer/CreateEvent – unauthorized campus access 4 Role-Based Access Validation (RBAC) Manipulating parameters on /api/ request (IDOR) 4
• 70.
  IMPLEMENTATION STRATEGY Risk Treatment Measure Prioritization Phase 2 Implementationand Monitoring 1. Apply Risk Treatments 2. Monitoring and Review 3. Long-term security Phase 3 Communication and Consultation 1. Stakeholder Communication 2. Feedback and Documentation Phase 4 Risk assessment 1. Risk identification 2. Risk Analysis 3. Risk Evaluation Phase 1 Page 70 of 78
• 71.
  REPEAT RISK ASSESSMENTPROCESS Repeat Risk Assessment Process Check and Add for a New Critical Asset Appeared Check for a Change of IT Environmen t New Risk Assessmen t Page 71 of 78
• 72.
  RISK ANALYSIS Qualitative Analysis Page 72of 78 No. Vulnerabilities Methods Consequences Impact Level 1 Testing for Exposed Session Variables Inspecting client-side code, analyzing responses, and reviewing session handling via Burp Suite or browser developer tools Exposure of session tokens or sensitive user-specific data may lead to session hijacking or privilege escalation. Low 2 Stack Trace Disclosure Triggering unexpected inputs or error conditions to observe server responses Reveals internal application structure, file paths, or code logic that can aid attackers in crafting targeted attacks. Low 3 Shortname Enumeration in IIS Using specially crafted requests (e.g., ~1) to detect 8.3 filename format support in IIS May allow attackers to infer hidden files or directories, leading to information disclosure or targeted file access. Low
• 73.
  RISK ANALYSIS Quantitative Analysis Page 73of 78 No. Vulnerability Name Consequences Impact Level 1 Cross-Site Scripting This may allow attackers to forge requests to CSRF using XSS payloads, deface the UI, or perform phishing within the application context. High 2 Cross-site Request Forgery Enables unauthorized actions on behalf of authenticated users without their consent, leading to potential data manipulation or privilege escalation. High 3 Insecure Direct Object References Attackers can access or manipulate unauthorized data by modifying object references in requests. High 4 Cross-site Request Forgery Enables unauthorized actions on behalf of authenticated users without their consent, leading to potential data manipulation or privilege escalation. Medium 5 Insecure Direct Object References Attackers can access or manipulate unauthorized data by modifying object references in requests. Medium 6 Cross-site Request Forgery Enables unauthorized actions on behalf of authenticated users without their consent, leading to potential data manipulation or privilege escalation. Medium
• 74.
  RISK ANALYSIS Quantitative Analysis Page 74of 78 No. Vulnerability Name Consequences Impact Level 7 Insecure Direct Object References Attackers can access or manipulate unauthorized data by modifying object references in requests. Medium 8 Cross-site Request Forgery Enables unauthorized actions on behalf of authenticated users without their consent, leading to potential data manipulation or privilege escalation. Medium 9 Cross-site Request Forgery Enables unauthorized actions on behalf of authenticated users without their consent, leading to potential data manipulation or privilege escalation. Medium 10 Insecure Direct Object References Attackers can access or manipulate unauthorized data by modifying object references in requests. Medium 11 Business Logic Data Validation Bypassing logic checks may lead to inconsistent states, financial fraud, or bypass of authorization constraints. Medium 12 Test Upload of Unexpected File Types May allow attackers to upload unexpected file types and bypass file filters. Low
• 75.
  RISK ANALYSIS Provable Risk Mitigation Page75 of 78 No. Vulnerabilities Recommendation 1 Cross-Site Scripting HTML Sanitization Contextual Output Encoding Content Security Policy (CSP) Restrict Input to Markdown or Whitelisted HTML 2 Cross-site Request Forgery (RejectReportedEvent Functionality) Implement Anti-Forgery Token SameSite Cookie Policy 3 Insecure Direct Object References (UpdateFeedback and DeleteFeedback) Ownership Verification Centralized Authorization Checks Remove UserId from Client Input 4 Cross-site Request Forgery (DeleteGroup Functionality) Implement Anti-Forgery Token SameSite Cookie Policy 5 Insecure Direct Object References (GetFeedback Functionality) Event Status Validation Role-Based Feedback Access Control Centralized Event Access Policy
• 76.
  Vulnerability Demo IAP491_01 August 30,2025 Page 76 of 78
• 77.
  Q & A Section IAP491_01August 30, 2025 Page 77 of 78
• 78.
  THANKS FOR YOUR ATTENTION IAP491_01August 30, 2025 Page 78 of 78