[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-572449-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-572449-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","application-security-assessment-of-the-infinity-e-commerce-platform-issue-10-executive-summary","Application Security Assessment of the Infinity E-Commerce Platform - Issue 1.0 - Executive Summary","","Dunder Mifflin contracted SSG to assess application security for the Infinity e-commerce platform, covering both unauthenticated and authenticated attacker perspectives. Testing ran from June 29 to July 6, 2022, focusing on protecting sensitive customer and company information and preventing compromise of the application infrastructure. Results identified two critical, four high-risk, four medium-risk, and ten low-risk vulnerabilities, plus one informational finding. Root causes included insufficient input validation, broken access controls, excessive information exposure, weak communications encryption, and application server misconfigurations.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/general/","General",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/application-security-assessment-of-the-infinity-e-commerce-platform-issue-10-executive-summary/572449/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/application-security-assessment-of-the-infinity-e-commerce-platform-issue-10-executive-summary/572449.png","ImageObject",442,249,{"name":42,"@type":43},"asba","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-22","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",6,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What was the objective of the Infinity application security assessment?","Question",{"text":63,"@type":64},"The assessment aimed to ensure the Infinity web application was not vulnerable to security issues that could expose sensitive customer and company information or compromise the application infrastructure.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"When and how was the Infinity platform tested?",{"text":68,"@type":64},"SSG tested the application between June 29 and July 6, 2022, using both unauthenticated and authenticated attacker perspectives.",{"name":70,"@type":61,"acceptedAnswer":71},"How many vulnerabilities were found, and what were the main risk categories?",{"text":72,"@type":64},"SSG identified two critical, four high-risk, four medium-risk, and ten low-risk vulnerabilities, plus one informational finding.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},572449,1792086201,{"code":4,"msg":82,"data":83},"success",[84,89,94,99,104,109,114,119,124],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":86,"show_sort_weight":87,"slug":88},11,"Presentations",90,"presentations",{"id":90,"doc_module":22,"doc_module_name":25,"category_name":91,"show_sort_weight":92,"slug":93},12,"Resumes",80,"resumes",{"id":95,"doc_module":22,"doc_module_name":25,"category_name":96,"show_sort_weight":97,"slug":98},14,"Invoices",70,"invoices",{"id":100,"doc_module":22,"doc_module_name":25,"category_name":101,"show_sort_weight":102,"slug":103},15,"Posters",60,"posters",{"id":105,"doc_module":22,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},16,"Social Media",50,"social-media",{"id":110,"doc_module":22,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},17,"Forms",40,"forms",{"id":115,"doc_module":22,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},18,"Letters",30,"letters",{"id":120,"doc_module":22,"doc_module_name":25,"category_name":121,"show_sort_weight":122,"slug":123},21,"Paper Templates",5,"papers-templates",{"id":125,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":4,"slug":126},158,"general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":125,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":136,"language":137,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":12,"update_tm":141,"read_time":142},3985747872567,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","SECRET  \nApplication Security Assessment of the Infinity E-Commerce Platform  \nDunder Mifflin Paper Company Inc.  \n07-08-2022  \nSECRET  \nDocument Control  \n\n| Date | Changed By | Change | Issue |\n| --- | --- | --- | --- |\n| 07-06-2022 | Abdullah Ansari | Document Created | 0.1 |\n| 07-07-2022 | Javier Serrano | Document Technical QA | 0.2 |\n| 07-07-2022 | Cale Black | Document Technical QA | 0.3 |\n| 07-08-2022 | Abdullah Ansari | Document Published | 1.0 |\n\nDocument Distribution  \n\n| Date | Name | Company |\n| --- | --- | --- |\n| 07-08-2022 | Dwight Schrute | Dunder Mifflin Paper Company Inc. |\n\nContents  \n1 Executive Summary ............................................................................. 4  \n2 Summary of Vulnerabilities ................................................................. 5  \n3 Findings and Recommendations........................................................ 6  \n3.1 Assessment Overview..........................................................................................................................6  \n3.2 Summary of Vulnerabilities .................................................................................................................6  \n4 Vulnerability Descriptions ................................................................. 13  \n4.1 Critical Vulnerabilities ........................................................................................................................ 14  \n4.2 High-Risk Vulnerabilities ....................................................................................................................24  \n4.3 Medium-Risk Vulnerabilities ..............................................................................................................38  \n4.4 Low-Risk Vulnerabilities .....................................................................................................................49  \n4.5 Informational Vulnerabilities .............................................................................................................73  \nAppendix I-Server Port Scan .................................................................. 75  \nAppendix II-Modified ASPX Web Shell .................................................. 76  \nAppendix III-Assessment Scope ............................................................ 77  \nAppendix IV-Assessment Artefacts ....................................................... 78  \nAppendix V-Project Team ....................................................................... 79  \n1 Executive Summary  \nDunder Mifflin contracted SSG to conduct an application security assessment of their Infinity e-commerce platform. SSG performed testing between the 29th of June and the 6th of July 2022 from the perspective of both an unauthenticated and an authenticated attacker.  \nInfinity is a public storefront used by Dunder Mifflin’s customers to purchase various paper products online. There is also an administrative section of the application used by Dunder Mifflin employees to view sales data, trends, and security logs. The objective of the assessment was to provide Dunder Mifflin assurance that the Infinity web application was not vulnerable to security issues that could result in the exposure of sensitive customer and company information or compromise of the application infrastructure. This report contains details of the assessment’s findings, as well as recommendations for remediation.  \nOver the course of testing SSG identified two critical risk, four high-risk, four medium-risk, and ten low-risk vulnerabilities as well as one informational finding.  \nThe causes of these vulnerabilities are as follows:  \n• Lack of input validation and sanitization  \n• Broken access controls and missing authorization checks  \n• Excessive information exposure  \n• Lack of communications encryption  \n• Misconfigurations in the application server  \nAttackers can exploit these weaknesses in the application to gain various levels of access to the ","cbCainbPgpeb0599","https://ap.wps.com/l/cbCainbPgpeb0599","pdf",1791961,79,"English","# Executive Summary\n## Assessment Scope and Testing Approach\n## Key Findings and Risk Distribution\n## Vulnerability Root Causes\n## Impact Scenarios and Recommended Remediation","[{\"question\":\"What was the objective of the Infinity application security assessment?\",\"answer\":\"The assessment aimed to ensure the Infinity web application was not vulnerable to security issues that could expose sensitive customer and company information or compromise the application infrastructure.\"},{\"question\":\"When and how was the Infinity platform tested?\",\"answer\":\"SSG tested the application between June 29 and July 6, 2022, using both unauthenticated and authenticated attacker perspectives.\"},{\"question\":\"How many vulnerabilities were found, and what were the main risk categories?\",\"answer\":\"SSG identified two critical, four high-risk, four medium-risk, and ten low-risk vulnerabilities, plus one informational finding.\"}]","Application Security Assessment of the Infinity E-Commerce Platform - Issue 1.0 - Executive Summary | PDF",1791927441,28]