0

We have several websites that are client facing at a very large company. These websites do gather client information. They were written 6-7 years ago, quite possibly using a PHP/mysql code generator. It hasn't been touched since. The code gives very very basic CMS functionality - puts a few field items in a template.

Without being able to audit the code or directly access the sites (I have seen demos) I am being asked to estimate the security vulnerabilities of the site and how long it would take to rebuild. I run the web OPS group for my sector and this is another sector so there are some political issues in the way. I have my opinion about possible issues but would like to hear others too.

Server is LINUX running apache 2. Running older versions of PHP and mysql. Clients are forced to fill out a form to see content so we are storing a bunch of client info in plain text on the site. Passwords are not salted and not even sure hashed. Let me know if there is anything I can add to make the question better.

1
  • 1
    It sounds like you basically need to run a pen test against the sites. Describing how to do that is beyond the scope of this site. Jan 29, 2016 at 3:19

2 Answers 2

2

Well first of all its an assumption, so assume away!

Your talking about the PHP code's security, so can we ignore the outdated versions of the stack: Linux, Apache, PHP, MySQL. All of which you should be able to pull up a number of exploits for (knowing the version) via Google. We can then talk about the PHP application. The code is going to be as secure as it was written.

You mentioned some kind of code generator was used to create it? Which one? I recommend you find out, and get some samples of what it generates. Considering the age there is a good chance it doesn't take into consideration of few common vulnerabilities: XSRF, XSS, SQL Injection.

They don't call it "Pen Testing" for nothing.

I'll try to be more helpful... by giving you a bunch of questions for you to find answers to.

What kind of information do these sites collect? Does the CMS side of the site have logins? Does the site use session cookies to authenticate? Try logging in and have a look at the network logs with the inspector in Chrome/FF.

Also what kinda of attacks are you worried about? What information is stored in the site that is sensitive? Are the servers inside a network that contains other sensitive data or assets? Try to model your potential threats and what worst case scenarios they could create.

2
  • Assume away - it is about all I can do. I have done some very basic pen testing. I have found a few issues already. I am afraid to do to much pen testing because I know they can push some false positives and I would rather not bring up things I am not 110% of and present them as findings or facts. The CMS has admin logins for DB access and any user with an email - and any user within certain IP ranges can login. Worries - client data, client usage (secretive industry), internal only videos and pages that are only done with IP checks...
    – blankip
    Jan 29, 2016 at 4:44
  • Also I use a really good code generator - just for report tables and just on internal servers. The generator I use has several releases a year for exploits and vulnerabilities fixes. I can't imagine a generator from 2008 that is that locked down no matter which one it was.
    – blankip
    Jan 29, 2016 at 4:48
0

You don't know enough to make a call. Given the technology involved, the baseline is it could be very, very bad. To raise it above that you need to test it or look at the code or both.

2
  • It could also be very good, maybe they made it with CakePHP and good secure design practises and tested the crap out of the code... maybe(probably) not.
    – Zv_oDD
    Jan 29, 2016 at 4:04
  • That's true of course, but you can't assume the best in a security assessment :)
    – O'Rooney
    Jan 29, 2016 at 4:06

Not the answer you're looking for? Browse other questions tagged .