1444_CT_IAP491_01_Slides_Capstone_Project.pptx

Capstone_Project

1. CAPSTONE PROJECT PRESENTATION Analysis and Security Assessment of Online Event Management Systems Presented By: IAP491_01 Supervisor Luong Hoang Huong Page 1 of 78

2. OUR TEAM PHAM TRONG TINH TRINH PHUONG HUY MEMBER MEMBER VO HOANG PHUC UNG NHAT TIEN NGUYEN PHUOC THINH LEADER MEMBER MEMBER Page 2 of 78

3. TABLE OF CONTENT 1. PROJECT INTRODUCTION 2. PROJECT MANAGEMENT PLAN 3. RISK ASSESSMENT 4. RISK MANAGEMENT PLAN 5. Demo Page 3 of 78 6. Q&A

4. 1. PROJECT INTRODUCTION IAP491_01 August 30, 2025 Page 4 of 78

5. OVERVIEW EVENT MANAGEMENT APPS LIKE THE FPT EVENT MANAGEMENT SYSTEM HANDLE SENSITIVE DATA AND IOT CONTROLS, MAKING SECURITY VITAL. WITH RISKS FROM BOTH WEB AND MOBILE PLATFORMS, THIS PROJECT APPLIES TAILORED PENETRATION TESTS AND CHECKLISTS TO FIND AND FIX VULNERABILITIES BEFORE EXPLOITATION. 1. PROJECT INTRODUCTION Page 5 of 78

6. 1. PROJECT INTRODUCTION Introduction Information System Event Management System (EMS) THE EVENT MANAGEMENT SYSTEM (EMS) MANAGES EVENTS ACROSS FPT UNIVERSITY WITH FOUR ROLES: STUDENT, ORGANIZER, MANAGER, AND ADMINISTRATOR. ITS MOBILE APP SUPPORTS EVENT MANAGEMENT, REGISTRATION, AND SMARTTV INTEGRATION FOR PRESENTATIONS. Page 6 of 78

7. Use Cases of Event Management System(1) Page 7 of 78

8. Use Cases of Event Management System(2) Page 8 of 78

9. Use Cases of Event Management System(3) Page 9 of 78

10. 1. PROJECT INTRODUCTION CONFIDENTIALITY Protects sensitive data like attendee names, event details, and feedback; ensures only authorized access. INTEGRITY Maintains accuracy and consistency of event data, ensuring reliable reports and decision-making. AVAILABILITY Ensures EMS is operational with minimal downtime, enabling smooth schedules, updates, and live interactions. C-I-A IN EMS Page 10 of 78

11. 1. PROJECT INTRODUCTION Deployment Architecture Deployment Diagram UML Page 11 of 78

12. WEB APPLICATION MOBILE APPLICATION METHODOLOGY MULTI-ROLE ATTACK SIMULATION Pentesting using OWASP-based methods for common vulnerabilities (Injection, XSS, IDOR, SSRF, Security Misconfiguration). Source code review, insecure data/API checks, and OWASP Mobile Top 10 testing. Black-box & Gray-box testing with simulated accounts. Testing Anonymous and Authenticated roles (Student, Organizer, Manager, Admin, Super roles) for access control, privilege escalation, logic flaws, and insecure communication. PROJECT SCOPE 1. PROJECT INTRODUCTION The thesis evaluates and enhances the security of FPT University’s Event Management System (EMS) on Web and Mobile platforms through multi-layered security assessments. OUTCOME Tailored pentest framework, detailed vulnerability report, and prioritized remediation strategies. Page 12 of 78

13. 2. Project Management Plan IAP491_01 August 30, 2025 Page 13 of 78

14. OVERVIEW Project management is the key to successfully implementing FPT Event Management Application penetration testing. 2. PROJECT MANAGEMENT PLAN Using structured project management principles enables systematic planning, efficient resource use, risk mitigation, and quality assurance in penetration testing for FPT’s web and Android event management application Page 14 of 78

15. Project Management Framework Page 15 of 78

16. Scope & Estimation WORK BREAKDOWN STRUCTURE Page 16 of 78

17. ROLES AND RESPONSIBILITIES Team Roles Representation Diagram Page 17 of 78

18. PROJECT RISK MANAGEMENT RISK MANAGEMENT Page 18 of 78

19. TOOLING Page 19 of 78

20. PROJECT TIMELINE MILESTONE PLAN CHART Page 20 of 78

21. PROJECT TIMELINE GANTT CHART Page 21 of 78

22. PROJECT TIMELINE CRITICAL PATH Page 22 of 78

23. QUALITY ASSURANCE PROCESS WEB / MOBILE APPLICATION TESTING AND REPORT PROCESS Page 23 of 78

24. 3. RISK ASSESSMENT (1) IAP491_01 August 30, 2025 Page 24 of 78

25. THE NEED OF ASSESSMENT IS THE REQUIREMENT OF A KEY PROCESS THAT ORGANIZATIONS NEED TO UNDERTAKE TO IDENTIFY AND MITIGATE POTENTIAL RISKS, ESPECIALLY DURING THE DEVELOPMENT PERIOD. 3. RISK ASSESSMENT Page 25 of 78

26. ASSETS IDENTIFICATION Page 26 of 78 Attribute Details Asset Type Credentials Probability Factors Weak or reused passwords- Lack of multi-factor authentication- Poor session management or insecure credential storage/transmission- Poor role-based access control, enabling privilege escalation Probability Medium Impact Factors Unauthorized access to sensitive event and user data- Full system control if Administrator account compromised- Spoofing, privacy violations, and data integrity issues for other roles- Reputational damage, privacy breaches, regulatory issues, event disruption Impact High Attribute Details Asset Type Penetration Testing Resources Probability Factors Insecure storage (unencrypted files, exposed GitHub repos) Sharing over insecure channels Use of shared testing environments or cloud storage Probability Medium Impact Factors - Exposure of vulnerabilities before fixes - Use of stolen payloads to attack live systems - Loss of confidentiality of sensitive test results - Violation of responsible disclosure policies - Reputational, legal, and contractual risks Impact Critical ${pageNumberOfTotal}

27. INFORMATION ASSET CLASSIFICATION Page 27 of 78 Attribute Details Asset Type Application Source Code Probability Factors - Public or misconfigured version control systems - Source files left on exposed servers or shared machines - Leaks via unsecured cloud sharing or email - Improper access controls on repositories - Lack of obfuscation in mobile apps Probability Low Impact Factors - Discovery of vulnerabilities before fixes - Theft of proprietary logic and algorithms - Exposure of hardcoded secrets - Facilitation of reverse-engineering - Intellectual property theft - Legal liabilities - Reputational damage and customer trust loss Impact High Attribute Details Asset Type Display Devices Probability Factors - Outdated firmware - Lack of network segmentation - Unchanged default credentials - Unpatched vulnerabilities - Open remote ports Probability Low Impact Factors - Foothold into internal networks - Unauthorized content injection - Covert surveillance via embedded hardware - Persistent backdoors resistant to reboot cleanup Impact Medium

28. LOGICAL ARCHITECTURE Page 28 of 78

29. THREAT IDENTIFICATION Page 29 of 78 No Threats 1 Phishing Attacks 2 Malware / Ransomware 3 Insider Threats 4 Denial-of-Service (DoS) 5 Natural Disasters 6 Third-Party Component Exploits 7 Zero-Day Exploits

30. VULNERABILITY IDENTIFICATION Page 30 of 78 No Vulnerabilities 1 Cross-Site Scripting[12] (WSTG-INPV-02) 2 Insecure Direct Object References[13] (WSTG-INPV-02) 3 Webpage Content for Information Leakage[14] (WSTG-INFO-05) 4 Cross-site Request Forgery[15] (WSTG-SESS-05) 5 Business Logic[16] (WSTG-BUSL-01) 6 Stack trace[17] (WSTG-ERRH-02) 7 Test Upload of Unexpected File Types[18] (WSTG-BUSL-08)

31. IMPACT ASSESSMENT Page 31 of 78 No Threats / Vulnerabilities Impact 1 Malware and Ransomware Significant Severity 2 Denial of Service (DDoS) Attacks Significant Severity 3 Insider Threats Catastrophic Severity 4 Phishing Attacks Major Severity 5 Natural Disasters Catastrophic Severity 6 Zero-day exploit Catastrophic Severity 7 Third-Party Component Exploits Major Severity No Threats / Vulnerabilities Impact 8 Cross-Site Scripting (XSS) (WSTG-INPV-02) Significant Severity 9 Insecure Direct Object References (IDOR) (WSTG-INPV-02) Major Severity 10 Webpage Content for Information Leakage (WSTG-INFO-05) Minor Severity 11 Cross-Site Request Forgery (CSRF) (WSTG-SESS-05) Major Severity 12 Business Logic Flaws (WSTG-BUSL-01) Major Severity 13 Stack Trace Disclosure (WSTG-ERRH-02) Minor Severity 14 Upload of Unexpected File Types (WSTG-BUSL-08) Major Severity

32. LIKELIHOOD ASSESSMENT Page 32 of 78 No Threat / Vulnerability Likelihood Level 1 Malware and Ransomware Likely 2 Distributed Denial of Service (DDoS) Possible 3 Insider Threats Unlikely 4 Phishing Attacks Almost Certain 5 Natural Disasters Rare 6 Zero-day exploits Rare 7 Third-Party Component Exploits Likely 8 Cross-Site Scripting (XSS) Likely 9 Insecure Direct Object References (IDOR) Likely 10 Information Leakage (WSTG-INFO-05) Possible 11 Cross-Site Request Forgery (CSRF) Possible 12 Business Logic Flaws Possible 13 Stack Trace Disclosure Possible 14 Unexpected File Upload (WSTG-BUSL-08) Likely

33. RISK LEVEL MATRIX Page 33 of 78 Likelihood\Severity Catastrophic-5 Major-4 Significant-3 Minor-2 Insignificant-1 Almost Certain-5 Very High(25) Very High(20) Very High(15) High(10) Medium(5) Likely-4 Very High(20) Very High(16) High(12) Medium(8) Low(4) Possible-3 Very High(15) High(12) Medium(9) Medium(6) Low(3) Unlikely-2 High(10) Medium(8) Medium(6) Low(4) Very Low(2) Rare-1 Medium(5) Low(4) Low(3) Very Low(2) Very Low(1)

34. 4. RISK ASSESSMENT (2) IAP491_01 August 30, 2025 Page 34 of 78

35. Information Gathering Asset Identification & Classification Risk Identification Risk Analysis Control Identification & Assessment Risk Controlling & Monitoring Final Risk Rating RISK ASSESSMENT FLOW Risk Assessment Flow Page 35 of 78

36. INFORMATION GATHERING Archive Mining & Operator Interview (OSINT in Internal Context) Page 36 of 78

37. INFORMATION GATHERING Active Network & Service Enumeration Page 37 of 78

38. INFORMATION GATHERING Web & Application Fingerprinting Page 38 of 78

39. STANDARDS AND METHODS USED Threat Modeling & Analysis STRIDE – 6 categories of security threats PASTA – 7-step attack simulation & threat analysis Page 39 of 78 Applied Standards ISO/IEC 27001 – Information security management framework NIST SP 800-30 – Structured risk assessment methodology OWASP Testing Guide & Top 10 – Web application security checklist OWASP MASVS – Mobile application security framework Vulnerability Scoring CVSS v3.1 – Base, Temporal, Environmental scores

40. ASSET IDENTIFICATION Page 40 of 78

41. ASSET IDENTIFICATION Technical Infrastructure – 4-Tier Architecture Database Layer SQL Server: structured data (users, events, logs) Firebase: real-time push notifications & updates Presentation Layer (Client Layer) Web interface (Chrome, Safari) + Mobile app Google Sign-In, event view, registration, QR check-in, e-tickets Web Server Layer Windows Server + IIS 10.0 Enforces SSL, access control Hosts Website Module (browser interface) Hosts API Module (mobile app requests, real-time ops) Web Application Layer ASP.NET business logic User roles, event rules, data updates Integration with FAP API Page 41 of 78

42. ASSET CLASSIFICATION Page 42 of 78

43. RISK IDENTIFICATION Classification of threat object List of threat events Relationship between threat object vs asset Page 43 of 78

44. RISK IDENTIFICATION Relationship between threat object vs threat event Page 44 of 78

45. Stored Cross-Site Scripting (XSS) in CreateEvent via DescriptionHtml Parameter Business Logic Data Validation in Event Rejection RISK IDENTIFICATION Vulnerable identification Insecure direct object references - Student/UpdateFeedback and Student/DeleteFeedback Page 45 of 78 No Vulnerability Name 1 Cross-Site Scripting 2 Cross-site Request Forgery 3 Insecure Direct Object References 4 Cross-site Request Forgery 5 Insecure Direct Object References 6 Cross-site Request Forgery 7 Insecure Direct Object References 8 Cross-site Request Forgery 9 Cross-site Request Forgery 10 Insecure Direct Object References 11 Business Logic Data Validation 12 Testing for Exposed Session Variables 13 Stack Trace Disclosure 14 Test Upload of Unexpected File Types 15 Shortname Enumeration in IIS

46. RISK RATING Threat Actor Capability Assessment Vulnerability Characteristics Assessment Likelihood Assessment Page 46 of 78

47. RISK RATING Impact Assessment Technical Impact Assessment Business Impact Assessment Page 47 of 78

48. RISK RATING Risk Score Interpretation Risk Score Severity Matrix Likelihood scoring table Impact scoring table Page 48 of 78

49. RISK RATING Risk Rating Details Testing for Stored Cross-Site Scripting (XSS) in CreateEvent via DescriptionHtml Parameter Risk Likelihood Assessment Table of vulnerability Likelihood Score = (4 + 7 + 8 + 7 + 8 + 9 + 7 + 3) / 8 = 53 / 8 = 6.625 (High Likelihood) Page 49 of 78 Factor Score Rationale Threat Agent Factors Skill Level 4 Requires knowledge of XSS payload crafting and targeting rendered fields. Motive 7 High incentive to escalate privileges or steal session tokens. Opportunity 8 Any Organizer can inject a payload; stored XSS increases the chance of hitting privileged users. Size 7 Many potential attackers if the Organizer role is common across users. Vulnerability Factors Ease of Discovery 8 Easily identifiable through testing WYSIWYG/HTML input fields. Ease of Exploit 9 Once payload is stored, it auto-executes on page load for others. Awareness 7 XSS is well-known and documented in OWASP Top 10. Intrusion Detection 3 XSS may silently exfiltrate data or perform actions without detection.

50. RISK RATING Risk Rating Details Testing for Stored Cross-Site Scripting (XSS) in CreateEvent via DescriptionHtml Parameter Risk Impact Assessment Table of vulnerability Impact Score = (6 + 8 + 4 + 7 + 5 + 6 + 5 + 6) / 8 = 47 / 8 = 5.875 → (Medium Impact) Page 50 of 78 Factor Score Rationale Technical Impact Loss of Confidentiality 6 Attacker can steal session cookies, CSRF tokens, and sensitive user data. Loss of Integrity 8 Attacker can forge requests, modify victim data, or create unauthorized actions. Loss of Availability 4 Indirect DoS possible if malicious content disrupts rendering or logic. Loss of Accountability 7 Attacker can act on behalf of other users without traceability. Business Impact Financial Damage 5 Potential indirect damage if used for fraud or service abuse. Reputation Damage 6 Trust in the system is reduced if users see malicious or hijacked pages. Non-Compliance 5 Violates data protection and input handling policies. Privacy Violation 6 Sensitive information can be exfiltrated via JavaScript (e.g., names, email).

51. RISK RATING Risk Rating Details Testing for Stored Cross-Site Scripting (XSS) in CreateEvent via DescriptionHtml Parameter Risk Score = Likelihood × Impact = 6.625 × 5.875 = 38.92 OWASP Severity table of vulnerability Page 51 of 78 Likelihood Impact Severity High (6.625) Medium (5.875) High

52. SUMMARY FINDINGS Page 52 of 78 No Vulnerability Name OTG Affected Host/Path Risk Risk Score 1 Cross-Site Scripting WSTG-INPV-02 https://googleauthensite03.fpt.edu.vn:93/Organizer/CreateEvent (POST: DescriptionHtml ) High 38.92 2 Cross-site Request Forgery WSTG-SESS-05 https://googleauthensite03.fpt.edu.vn:93/Admin/DeleteBuilding/{building id} High 33 3 Insecure Direct Object References WSTG-ATHZ-04 https://googleauthensite03.fpt.edu.vn:93/Student/UpdateFeedback (POST: UserId,EventId,Value,CreatedDate,FeedbackContent) https://googleauthensite03.fpt.edu.vn:93/Student/DeleteFeedback (POST: UserId,EventId) High 31.25 4 Cross-site Request Forgery WSTG-SESS-05 https://googleauthensite03.fpt.edu.vn:93/Manager/DeleteGroup/{group id} Medium 28.2 5 Insecure Direct Object References WSTG-ATHZ-04 https://googleauthensite03.fpt.edu.vn:93/Home/GetFeedback (POST: eventId) Medium 27.31 6 Cross-site Request Forgery WSTG-SESS-05 https://googleauthensite03.fpt.edu.vn:93/Manager/DeleteCategory/{category id} Medium 26.8 7 Insecure Direct Object References WSTG-ATHZ-04 https://googleauthensite03.fpt.edu.vn:93/Organizer/CreateEvent (POST: Campus) Medium 24.06 8 Cross-site Request Forgery WSTG-SESS-05 https://googleauthensite03.fpt.edu.vn:93/Manager/AcceptEvent/{event id} Medium 24.06 9 Cross-site Request Forgery WSTG-SESS-05 https://googleauthensite03.fpt.edu.vn:93/Manager/RejectReportedEvent (POST:eventId) Medium 20.625 10 Insecure Direct Object References WSTG-ATHZ-04 https://googleauthensite03.fpt.edu.vn:93/api/smartTv/insertSmartTv Medium 20.19 11 Business Logic Data Validation WSTG-BUSL-01 https://googleauthensite03.fpt.edu.vn:93/Manager/RejectReportedEvent (POST:eventId) Medium 19.66 12 Testing for Exposed Session Variables WSTG-SESS-04 https://googleauthensite03.fpt.edu.vn:93/api/auth/smartTv/getTvAccessToken?idGoogleToken= Low 14.375 13 Stack Trace Disclosure WSTG-ERRH-02 https://googleauthensite03.fpt.edu.vn:93/ Low 6.3 14 Test Upload of Unexpected File Types WSTG-BUSL-08 https://googleauthensite03.fpt.edu.vn:93/Home/ManageProfile Low 6.09 15 Shortname Enumeration in IIS WSTG-INFO-07 https://googleauthensite03.fpt.edu.vn:93/ Low 4.64

53. 5. RISK MANAGEMENT PLAN IAP491_01 August 30, 2025 Page 53 of 78

54. Risk Treatment Measure Prioritization Phase 2 Implementation and Monitoring Apply Risk Treatments Monitoring and Review Long-term security Phase 3 Communication and Consultation Stakeholder Communication Feedback and Documentation Phase 4 Risk assessment Risk identification Risk Analysis Risk Evaluation Phase 1 RISK MANAGEMENT PROCESS AND PHASE Page 54 of 78

55. RISK MANAGEMENT PROCESS AND PHASE Page 55 of 78

56. Objectives of Risk Management Plan (RMP) Identify and Prioritize Security Risks Identify and Prioritize Security Risks Identify and Prioritize Security Risks Identify and Prioritize Security Risks Identify and Prioritize Security Risks Page 56 of 78

57. Threat Modeling Continuous Monitoring Risk Appetite & Tolerance Risk Register & Heat Map Risk Management Approach Qualitative & Quantitative Analysis Cost–Benefit Analysis (CBA) & BCR Ratio Page 57 of 78

58. 𝑹𝒊𝒔𝒌 = 𝑳𝒊𝒌𝒆𝒍𝒊𝒉𝒐𝒐𝒅 𝒙 𝑰𝒎𝒑𝒂𝒄𝒕 Risk Likelihood Impact QUALITATIVE & QUANTITATIVE ANALYSIS Page 58 of 78

59. COST–BENEFIT ANALYSIS (CBA) & BCR RATIO 𝑩𝑪𝑹 = 𝑻𝒐𝒕𝒂𝒍 𝑩𝒆𝒏𝒆𝒇𝒊𝒕 ÷ 𝑻𝒐𝒕𝒂𝒍 𝑪𝒐𝒔𝒕 Page 59 of 78

60. RISK REGISTER & HEAT MAP Page 60 of 78

61. Define the Objectives Define the Technical Scope Decompose the Application Analyze the Threats Vulnerability Analysis Attack Analysis (Simulation) Risk and Impact Analysis STRIDE Threat Modeling PASTA Page 61 of 78

62. RISK APPETITE & TOLERANCE Page 62 of 78 Risk Value (VND) Response Action Example < 30,000,000 VND Accept and monitor UI bug with no impact on core system logic 30,000,000 – 50,000,000 VND Mitigate within 30 days SQL injection o > 50,000,000 VND Immediate action; escalate to management Student data leakage impacting the university’s reputation

63. Key Risk Indicators(KRIs) Automated scanning tools Regular review cycles CONTINUOUS MONITORING Page 63 of 78

64. Risk Management Implementation Process Framing Risk Framing Risk Monitoring Risk AssessingRisk Responding to Risk Page 64 of 78

65. Risk Handling Planning Overview of Risk Handling Planning Risk Treatment Strategies Benefits of Structured Risk Handling RISK HANDLING PLANNING AND IMPLEMENTATION Page 65 of 78

66. RISK HANDLING IMPLEMENTATION Cross-site Request Forgery(CSRF) Insecure Direct Object Reference(IDOR) Cross-site Scripting(XSS) Page 66 of 78

67. Include @Html.AntiForgeryToken() within the form Adding [ValidateAntiForgeryToken] to controller Cross-site Request Forgery(CSRF) RISK HANDLING IMPLEMENTATION Page 67 of 78

68. Cross-Site Scripting (XSS) HTML Sanitization Contextual Output Encoding Content Security Policy (CSP) Restrict Input to Markdown or Whitelisted HTML Ownership Verification Remove UserId from Client Input Centralized Authorization Checks RISK HANDLING IMPLEMENTATION Insecure Direct Object Reference(IDOR) Page 68 of 78

69. RISK MANAGEMENT PROCESS AND PHASE Page 69 of 78 Measure Vulnerability Scope BCR Output Encoding (Html.Encode) Stored XSS – DescriptionHtml 5 Event Status Validation GetFeedback – unauthorized feedback 4.5 Remove UserId from Client Input Feedback endpoints (IDOR) 4 Restrict Client-Side Campus Input Organizer/CreateEvent – unauthorized campus access 4 Role-Based Access Validation (RBAC) Manipulating parameters on /api/ request (IDOR) 4

70. IMPLEMENTATION STRATEGY Risk Treatment Measure Prioritization Phase 2 Implementation and Monitoring Apply Risk Treatments Monitoring and Review Long-term security Phase 3 Communication and Consultation Stakeholder Communication Feedback and Documentation Phase 4 Risk assessment Risk identification Risk Analysis Risk Evaluation Phase 1 Page 70 of 78

71. REPEAT RISK ASSESSMENT PROCESS Repeat Risk Assessment Process Check and Add for a New Critical Asset Appeared Check for a Change of IT Environment New Risk Assessment Page 71 of 78

72. RISK ANALYSIS Qualitative Analysis Page 72 of 78 No. Vulnerabilities Methods Consequences Impact Level 1 Testing for Exposed Session Variables Inspecting client-side code, analyzing responses, and reviewing session handling via Burp Suite or browser developer tools Exposure of session tokens or sensitive user-specific data may lead to session hijacking or privilege escalation. Low 2 Stack Trace Disclosure Triggering unexpected inputs or error conditions to observe server responses Reveals internal application structure, file paths, or code logic that can aid attackers in crafting targeted attacks. Low 3 Shortname Enumeration in IIS Using specially crafted requests (e.g., ~1) to detect 8.3 filename format support in IIS May allow attackers to infer hidden files or directories, leading to information disclosure or targeted file access. Low

73. RISK ANALYSIS Quantitative Analysis Page 73 of 78 No. Vulnerability Name Consequences Impact Level 1 Cross-Site Scripting This may allow attackers to forge requests to CSRF using XSS payloads, deface the UI, or perform phishing within the application context. High 2 Cross-site Request Forgery Enables unauthorized actions on behalf of authenticated users without their consent, leading to potential data manipulation or privilege escalation. High 3 Insecure Direct Object References Attackers can access or manipulate unauthorized data by modifying object references in requests. High 4 Cross-site Request Forgery Enables unauthorized actions on behalf of authenticated users without their consent, leading to potential data manipulation or privilege escalation. Medium 5 Insecure Direct Object References Attackers can access or manipulate unauthorized data by modifying object references in requests. Medium 6 Cross-site Request Forgery Enables unauthorized actions on behalf of authenticated users without their consent, leading to potential data manipulation or privilege escalation. Medium

74. RISK ANALYSIS Quantitative Analysis Page 74 of 78 No. Vulnerability Name Consequences Impact Level 7 Insecure Direct Object References Attackers can access or manipulate unauthorized data by modifying object references in requests. Medium 8 Cross-site Request Forgery Enables unauthorized actions on behalf of authenticated users without their consent, leading to potential data manipulation or privilege escalation. Medium 9 Cross-site Request Forgery Enables unauthorized actions on behalf of authenticated users without their consent, leading to potential data manipulation or privilege escalation. Medium 10 Insecure Direct Object References Attackers can access or manipulate unauthorized data by modifying object references in requests. Medium 11 Business Logic Data Validation Bypassing logic checks may lead to inconsistent states, financial fraud, or bypass of authorization constraints. Medium 12 Test Upload of Unexpected File Types May allow attackers to upload unexpected file types and bypass file filters. Low

75. RISK ANALYSIS Provable Risk Mitigation Page 75 of 78 No. Vulnerabilities Recommendation 1 Cross-Site Scripting HTML Sanitization Contextual Output Encoding Content Security Policy (CSP) Restrict Input to Markdown or Whitelisted HTML 2 Cross-site Request Forgery (RejectReportedEvent Functionality) Implement Anti-Forgery Token SameSite Cookie Policy 3 Insecure Direct Object References ( UpdateFeedback and DeleteFeedback ) Ownership Verification Centralized Authorization Checks Remove UserId from Client Input 4 Cross-site Request Forgery (DeleteGroup Functionality) Implement Anti-Forgery Token SameSite Cookie Policy 5 Insecure Direct Object References (GetFeedback Functionality) Event Status Validation Role-Based Feedback Access Control Centralized Event Access Policy

76. Vulnerability Demo IAP491_01 August 30, 2025 Page 76 of 78

77. Q & A Section IAP491_01 August 30, 2025 Page 77 of 78

78. THANKS FOR YOUR ATTENTION IAP491_01 August 30, 2025 Page 78 of 78