I. PART I : IDENTIFY VULNERABILITIES, THREATS, IMPACTS (35 points) IDONTCARE is a popular company doing e-commerce. They are located in a country where government is strict in protecting personal...

Assignment 1
I. PART I : IDENTIFY VULNERABILITIES, THREATS, IMPACTS (35 points)
IDONTCARE is a popular company doing e-commerce. They are located in a country where government is strict in protecting personal information’s. Any company which neglects its obligations of protection personal information pays a large fine which represents 30% of the turnover. System architecture is described through the figure 1.
Figure 1 : IDONTCARE system architecture for e-commerce The backend server use following:

· Operating system Redhat 6
· Backend uses Apache Struts 2.3.10 as framework Database server is a mysql 5
Please answer the questions below:
1. Question 1: identify at least 4 vulnerabilities for IDONTCARE systems (2 for architectural view and 2 for non architectural view). You must explain and provide CVEs if applicable. (10 points)
· https://access.redhat.com/documentation/en- us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide- security_threats
· The    First    problem    is    connecting    to    internet,    based    on    the www.marketing91.com/disadvantages-of-e-commerce/
· https://www.webdew.com/blog/e-commerce-website-design
1) Security Due to attacks by cybercriminals and hackers, online portals have received a lot of media attention. 
2) The availability of an internet connection is essential for e-commerce.
3) There is no chance of a tried-and-true product.
4) Delayed delivery
4) Delayed delivery
5) Lack of privacy, Tax difficulties, Legal Concerns, and the potential for Phishing are among the other issues.
· A flaw in Apache Struts has been found that might lead to remote code execution. An open - sourced framework called Apache Struts is used to create Java web applications. Remote code execution can be possible if this vulnerability is successfully exploited.
    
Access
    Vector
    Complexity
    Authentication
    
    NETWORK
    MEDIUM
    NONE
• One of the most widely used relational management systems available is called MySQL, and it is employed to store data for web servers and webpages. The majority of well-liked web servers and frameworks have MySQL as its default database.
•
In order to safeguard our data, MySQL has numerous vulnerabilities that we must be aware of. In this post, we will examine these various flaws and identify fixes.
2. Question 2: Identify 2 threats. You must explain and provide references to justify your point of view (10 points)
a) A successful hacker can get database records, add, change, and remove entries in the database, as well as access authenticated and permitted areas of a web web-based application or server.
b) Cross Site Scripting (XSS) - Client Hijacking: This attack takes advantage of a flaw in a website by inserting malicious programs that will execute on the client's end. The objective is to run a script that has been embedded in a website page of the a web app in the attacker's preferred pattern. Every time the website loads or when a connected event occurs, the code can be run.
3. Question 3: Provide 2 business impact for the company concerned? (10 points)
a) Remote A particularly special vulnerability known as remote preauth account enumeration only arises when user-generated inputs are not thoroughly checked before being submitted to the database query. This is a particular attack that aims to harm a remote user.
vulnerability for enumeration in the MySQL server database. The attacker's goal is to determine whether a specific user or username is genuine or already exists in your database, and then, using the produced error messages, to figure out a way around it in order access the user's sensitive information.
This flaw may be used by a malicious person to compile a list of legitimate usernames and obtain unapproved access to confidential information. A malicious user can thus verify if a certain username is being used by the SQL database instance using this vulnerability. If the account is invalid, it responds with "Access refused" error messages. If it produces a different answer, the attacker can verify that the user is indeed there. The following versions are affected by this vulnerability: Oracle MySQL versions prior to 5.6.19 and 5.5.38.
· To avoid this, you need to sanitize user–generated inputs and upgrade to later versions after the ones mentioned. https://www.securecoding.com/blog/top-5-mysql-vulnerabilities-and-how-to-fix- them/
b) Race Condition: When a system, device, or piece of software attempts to perform two or more installers, a race condition results. However, because of the nature of the device or system the operations should be executed in the correct order or timing due to the other unforeseen events to ensure that it is done effectively. In the case of MySQL, this flaw may result in a race situation, which may be quite harmful. It can enable a local user with database access to increase their privileges and execute any code under the guise of the data local user.
There is a race condition in Oracle MySQL versions prior to 5.5.52, 5.6.x prior to 5.6.33, 5.7.x prior to 5.7.15, 8.x...