A SaaS platform provider asked ioSENTRIX to test its customer-facing web application, its APIs and its administrative interfaces.
Our testers treated each gap as a step rather than a separate finding, then proved the chain end to end: from an anonymous visitor to a working administrator account.
Middle step of the chain: missing tenant checks let any signed-in user read other customers’ records and billing. Also found: time-based SQL injection, stored and reflected cross-site scripting, CSRF, clickjacking and session-handling weaknesses.
Three gaps chained into a full takeover, and all are now closed.
Account dashboards sat behind predictable URLs with no authentication at all. Changing the number in the URL opened any customer’s account, its data and its admin functions.
Business impact. Anyone on the internet could browse customers’ business data without ever creating an account.
Organisation and user-management APIs answered requests without authentication. They allowed reading organisation data, listing customer groups, changing account status and creating users with elevated privileges.
Business impact. An attacker could take administrative control and change how customers’ accounts operate.
We found that an outsider could open customer dashboards without signing in, read other customers’ data with any account, and create privileged users through unprotected admin APIs. The client closed every finding, and ioSENTRIX retested the fixes.
35+ findings in total, including 4 Critical and 4 High.
✓ Verification: All closed by the client; retested by ioSENTRIX.
Each gap was serious on its own. Together they handed an outsider the whole platform.
Hidden URLs and unlinked APIs still get found (OWASP API5).
Use non-sequential IDs, and check ownership anyway.
A chain shows the real risk better than a list of separate issues.
Details in this case study are anonymised and generalised. Methods that could harm other products are withheld.
A SaaS platform provider asked ioSENTRIX to test its customer-facing web application, its APIs and its administrative interfaces.
Customer dashboards opened without a login. Anyone on the internet could browse customers’ business data without ever creating an account.
35+ findings in total, including 4 Critical and 4 High.
All closed by the client; retested by ioSENTRIX.
Web application and API penetration testing, delivered by the ioSENTRIX application security testers.
