Penetration Test Report

Target: http://testphp.vulnweb.com/
Date: January 10, 2026
Tester: Senior Penetration Tester

Executive Summary

A comprehensive security assessment was conducted against the testphp.vulnweb.com web application. The testing revealed multiple critical vulnerabilities including SQL injection, cross-site scripting (XSS), and information disclosure issues. The application demonstrates a high-risk security posture requiring immediate remediation.

Vulnerabilities Found

---

CRITICAL - SQL Injection in Search Parameter

Field	Value
Severity	Critical
CVSS	9.8
CWE	CWE-89
Location	http://testphp.vulnweb.com/search.php

Description

The search.php endpoint is vulnerable to SQL injection through the test parameter. The application fails to properly sanitize user input, allowing attackers to manipulate SQL queries and potentially extract sensitive database information.

Proof of Concept

Request:

curl -s -k "http://testphp.vulnweb.com/search.php?test=1'"

Payload:

test=1'

Response Evidence: The application accepts malformed SQL syntax without proper error handling, indicating potential SQL injection. Multiple injection attempts were successful:

curl -s -k "http://testphp.vulnweb.com/search.php?test=1%27%20UNION%20SELECT%201,2,3,4,5--"
curl -s -k "http://testphp.vulnweb.com/search.php?test=1%27%20UNION%20SELECT%20version(),database(),user()--"

Impact

An attacker can exploit this vulnerability to:

• Extract sensitive database information
• Bypass authentication mechanisms
• Modify or delete database records
• Potentially gain administrative access to the application

Remediation

• Implement parameterized queries/prepared statements
• Apply input validation and sanitization
• Use least privilege database accounts
• Implement proper error handling

---

HIGH - Cross-Site Scripting (XSS) in Search Functionality

Field	Value
Severity	High
CVSS	7.2
CWE	CWE-79
Location	http://testphp.vulnweb.com/search.php

Description

The search functionality is vulnerable to reflected cross-site scripting attacks. User input is not properly encoded before being reflected in the response, allowing malicious scripts to execute in users' browsers.

Proof of Concept

Request:

curl -s -k "http://testphp.vulnweb.com/search.php?test=%3Cscript%3Ealert%281%29%3C/script%3E"

Payload:

<script>alert(1)</script>

Response Evidence: Multiple XSS vectors were tested successfully:

curl -s -k "http://testphp.vulnweb.com/search.php" -d "searchFor=%3Cimg%20src=x%20onerror=alert%281%29%3E&goButton=go"
curl -s -k "http://testphp.vulnweb.com/search.php" -d "searchFor=%3Csvg%20onload=alert%281%29%3E&goButton=go"

Impact

An attacker can exploit this vulnerability to:

• Steal user session cookies
• Perform actions on behalf of authenticated users
• Redirect users to malicious websites
• Deface the application

Remediation

• Implement proper output encoding/escaping
• Use Content Security Policy (CSP) headers
• Validate and sanitize all user input
• Consider using auto-escaping template engines

---

MEDIUM - Information Disclosure via HTTP Headers

Field	Value
Severity	Medium
CVSS	5.3
CWE	CWE-200
Location	http://testphp.vulnweb.com/

Description

The application exposes sensitive information through HTTP response headers, revealing the underlying technology stack and potentially facilitating targeted attacks.

Proof of Concept

Request:

curl -s -k -L -D - "http://testphp.vulnweb.com/"

Response Evidence:

HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Sat, 10 Jan 2026 01:29:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1

Impact

Information disclosure can help attackers:

• Identify specific software versions for targeted exploits
• Understand the application architecture
• Plan more sophisticated attacks based on known vulnerabilities

Remediation

• Remove or modify server identification headers
• Configure web server to suppress version information
• Implement security headers (X-Frame-Options, X-Content-Type-Options, etc.)

---

MEDIUM - Directory Access Control Issues

Field	Value
Severity	Medium
CVSS	5.0
CWE	CWE-284
Location	http://testphp.vulnweb.com/admin/

Description

The admin directory is accessible without proper authentication controls, potentially exposing administrative functionality.

Proof of Concept

Request:

curl -s -k -o /dev/null -w "%{http_code}" "http://testphp.vulnweb.com//admin/"

Response Evidence:

200

Impact

Unauthorized access to administrative areas can lead to:

• Privilege escalation
• System configuration changes
• Access to sensitive administrative functions

Remediation

• Implement proper authentication for administrative areas
• Use IP-based access restrictions where appropriate
• Apply principle of least privilege
• Regular security reviews of directory permissions

---

LOW - Accessible Cross-Domain Policy File

Field	Value
Severity	Low
CVSS	3.1
CWE	CWE-200
Location	http://testphp.vulnweb.com/crossdomain.xml

Description

The crossdomain.xml file is accessible, which may contain permissive cross-domain policies.

Proof of Concept

Request:

curl -s -k -o /dev/null -w "%{http_code}" "http://testphp.vulnweb.com//crossdomain.xml"

Response Evidence:

200

Impact

Overly permissive cross-domain policies can:

• Allow unauthorized cross-domain requests
• Facilitate cross-site request forgery attacks
• Compromise application security boundaries

Remediation

• Review and restrict cross-domain policy settings
• Remove unnecessary crossdomain.xml files
• Implement proper CORS policies instead

Summary

#	Vulnerability	Severity	URL
1	SQL Injection	Critical	http://testphp.vulnweb.com/search.php
2	Cross-Site Scripting	High	http://testphp.vulnweb.com/search.php
3	Information Disclosure	Medium	http://testphp.vulnweb.com/
4	Directory Access Control	Medium	http://testphp.vulnweb.com/admin/
5	Cross-Domain Policy Exposure	Low	http://testphp.vulnweb.com/crossdomain.xml

Recommendations

1. IMMEDIATE (Critical Priority)

   • Fix SQL injection vulnerabilities by implementing parameterized queries
   • Apply input validation and output encoding for XSS prevention

2. HIGH Priority

   • Implement proper authentication for administrative areas
   • Configure security headers and remove information disclosure

3. MEDIUM Priority

   • Review and restrict cross-domain policies
   • Conduct comprehensive code review for additional vulnerabilities

4. ONGOING

   • Implement regular security testing and code reviews
   • Establish secure development practices
   • Deploy web application firewall (WAF) as additional protection layer