Food Tech Security Assessment

Internal Network Security • Penetration Testing • ISO Readiness

Client Overview

The client is a well-established Food Industry organization operating digital platforms including a public facing website and an internal ERP system used for production, logistics, and vendor management.

Problem

The client experienced rapid digital expansion and recognized the importance of securing their application layers. They were uncertain whether their current codebase and platform contained serious security vulnerabilities, and whether existing security controls were sufficient.

Client Requirements

The client approached us with a concern regarding potential security weaknesses within their source code, and requested a detailed security code review insight and remediation plan.

Our Approach To That
Their Ask

Requested a security audit through source code review to identify potential risks that could compromise data integrity, availability, and confidentiality.

Solution
Step 1: Requirement & Architecture Understanding
    Meetings with IT teams, development leads, and infrastructure team to understand:
  • Application architecture
  • Technology stack and frameworks used
  • Authentication & authorization workflow
  • Database integration and deployment structure
Step 2: Documentation Review

Reviewed all available development documentation and security-related policies (coding standards, change-management documentation, etc.)

Step 3: Manual & Automated Source Code Review
    Performed a static and manual code audit on the ERP and website modules to:
  • Identify insecure coding patterns
  • Analyze DB query handling
  • Validate input sanitization and output encoding
  • Review authentication & session management
Step 4: Vulnerability Validation

Execution-based validation conducted using controlled testing to reproduce and confirm findings.

Security Findings & Detailed Analysis

A total of 13 vulnerabilities were identified during the assessment. Below is an example of a high severity finding:

Critical Finding – SQL Injection on Login Page

The login page database query was found vulnerable to SQL Injection in the txtEmail parameter. This allowed unauthenticated attackers to manipulate database queries and gain access.

CVSS Score: 10.0 (Critical)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Steps to Reproduce

A proof-of-concept exploitation was carried out using SQLMap: sqlmap --random-agent --skip-waf --forms --dbms mssql -u http://<ip>:<port>/

Attack outcome:

  • Ability to enumerate database structure
  • Possible extraction of credential information
  • High likelihood of privilege escalation and lateral movement
Step 5: Risk Analysis

All findings were categorized and prioritised based on likelihood and business impact, creating a roadmap for resolution.

Step 6: Remediation Recommendations
  • Parameterized queries / stored procedures for all DB functions
  • Strict input validation and sanitization
  • Enable security headers (HSTS, CSP, X-Frame-Options)
  • Strong password hashing strategy using modern standards (bcrypt/argon2)
  • Review role-based access control structure
Step 7: Knowledge Transfer

Delivered detailed documentation of findings and conducted a remediation workshop with the internal development team.

Delivered Benefits
A senior stakeholder appreciated the outcome by stating
“We now feel confident in the security of our system and can continue development without fear of backend compromise.”
Secure Your Organization →