Web App Penetration Test — MeridianConnect
| Assessment | Web application penetration test |
| Target | MeridianConnect — a practice employee portal built to be insecure |
| Tester | C.W. |
| Date | 2026-10-21 |
This is a condensed summary. The full report, evidence, and remediated code are on GitHub.
Summary
I ran a full penetration test, start to finish, against an employee portal I built to be deliberately insecure — scoping it, breaking in, documenting the findings, fixing them, and re-testing. Testing was done safely against a private copy, so no live systems or real data were involved.
The site had five exploitable issues: one critical, one high, and three medium. The worst let anyone sign in as any employee with no password and read the whole staff database. All five were fixed and re-tested, and confirmed resolved.
Risk at a glance
| Severity | Count |
|---|---|
| Critical | 1 |
| High | 1 |
| Medium | 3 |
Findings
| # | Finding (plain terms) | Severity |
|---|---|---|
| 1 | Log in as anyone with no password, and read the whole database (SQL injection) | Critical |
| 2 | Any employee can read everyone's payslips by changing a number in the URL (IDOR) | Medium |
| 3 | A posted message can run code in other people's browsers (stored XSS) | Medium |
| 4 | Passwords stored as plain readable text, not scrambled | High |
| 5 | Developer/testing settings left on, leaking error details | Medium |
Proof
1 — Login bypass (SQL injection). Submitting admin' -- as the username,
with no valid password, logs straight in as the administrator (the server
redirects to the dashboard):
2 — Reading other people's pay (IDOR). Logged in as a normal employee,
changing the number in /payslip/4 reveals the HR Manager's pay:
3 — Running code in a browser (stored XSS). A note posted to the company board runs as code for everyone who views it:
Remediation
Each finding was fixed (parameterized queries, access-control checks, output escaping, password hashing, and hardened configuration) on a separate code branch, then re-tested to confirm the exploit no longer works while normal use of the site still does. All five: resolved.
Want the detail — CVSS scores, step-by-step reproduction, business impact, and the exact fixes? The full report and evidence are on GitHub.