A fictional engagement against a sample enterprise platform. Every target, finding and timestamp below is synthetic.
Demo only. The credentials testuser / mytestuserpass are intentionally
published here and protect nothing. No real assessment data exists behind this page.
The platform presents a moderate security risk driven primarily by authorisation weaknesses in the API layer. The most severe finding allows one authenticated tenant to read another tenant's records by editing a predictable object identifier. Two further findings compound it: a privilege escalation on the role-update flow and a stored cross-site scripting issue in shared workspace content. Remediate tenant isolation and the role-update authorisation first, then close the client-side hardening gaps.
Meaningful controls are in place, but two high-impact authorisation issues should be closed before the next audit window.
Any authenticated user can retrieve records belonging to another organisation by incrementing a predictable resource identifier. Tenant isolation is broken across every customer on the affected path.
GET /api/v1/••••/records/{id}
The server trusts a client-supplied role field when processing a role change, so a member-level account can reach an administrator-only capability within its tenant.
POST /api/v1/••••/members/role
Markup stored through the API bypasses client-side sanitisation and executes in the authenticated session of any colleague who opens the shared workspace.
Throttling is bound to source address rather than to the targeted account, so attempts distributed across addresses avoid lockout.
POST /auth/login
Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are absent, and HSTS max-age is too short. Nothing is exploitable through this alone, but the gaps removed the controls that would have contained EX-003.
EX-001 exposes records across tenants and identifies an administrator. EX-003 delivers a payload into a workspace shared with that administrator. EX-002 elevates a controlled account. Outcome: full administrative control of the target tenant with cross-tenant read retained. Each step was individually validated; the chain was not executed end to end against a live tenant.
The full report adds methodology, rules of engagement, per-finding evidence, reproduction steps, CVSS vectors, cross-cutting analysis and the compliance mapping appendix.
Open the sample reportIllustrative data only. The target, operator, findings, scores and timestamps on this page are fictional or masked for demonstration. No client-identifying information is shown anywhere in this sample, and Exceed does not publish real engagement data without written client permission.