We have several websites that are client facing at a very large company. These websites do gather client information. They were written 6-7 years ago, quite possibly using a PHP/mysql code generator. It hasn't been touched since. The code gives very very basic CMS functionality - puts a few field items in a template.
Without being able to audit the code or directly access the sites (I have seen demos) I am being asked to estimate the security vulnerabilities of the site and how long it would take to rebuild. I run the web OPS group for my sector and this is another sector so there are some political issues in the way. I have my opinion about possible issues but would like to hear others too.
Server is LINUX running apache 2. Running older versions of PHP and mysql. Clients are forced to fill out a form to see content so we are storing a bunch of client info in plain text on the site. Passwords are not salted and not even sure hashed. Let me know if there is anything I can add to make the question better.