Skip to content

Report

A good report answers two questions: how big is the risk, and what exactly do we do about it? This is how a Mr Cyber report is structured.

Request a full report

What’s in the report

  1. Executive summary

    The risk picture on one page, for management and auditors.

  2. Scope & methodology

    Targets, timeframe, test type and standards, clearly documented.

  3. Findings overview

    All findings prioritised by risk, with status.

  4. Detailed findings

    Description, reproduction, evidence, impact, remediation, CVSS 3.1.

  5. Remediation plan

    What to fix first, with effort estimates.

  6. Retest confirmation

    Proof of fixed findings for your auditor.

  7. Ticket import file

    Every finding as CSV, JSON and email for Jira, ServiceNow, GitLab, Azure DevOps and GitHub. Helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 receive them by email import.

  8. Attestation letter

    One page for auditors, customers and insurers, without the confidential report.

A single finding

Pentest report · Admin & Söhne GmbH · MC-2026-014
Risk: High CVSS 3.1 · 8.2 Open · retest included

Admin area reachable without login

app.admin-soehne.example · /admin

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Description

The administration area at /admin opens without asking for a password. Anyone who types the address sees the full customer list with names, addresses and order history, and can change a few settings such as the shop’s opening notice.

Steps to reproduce

  1. Open a private browser window, without logging in.
  2. Go to https://app.admin-soehne.example/admin.
  3. The admin dashboard loads, showing all customers and edit buttons.
GET /admin HTTP/2
Host: app.admin-soehne.example

HTTP/2 200
<title>Admin Dashboard</title> …

Business impact

Anyone on the internet can read all customer data, with no account and no special skill. That is a GDPR data breach that must be reported within 72 hours, plus a letter to every customer. Search engines or automated scanners can find this kind of page within days.

Remediation

Protect the whole /admin area with a mandatory login on the server, and require two-factor authentication for admins. Better still, make the admin area reachable only from the company network or VPN. Add an automated test that checks every admin page refuses access without login.

OWASP Top 10 2021: A01 Broken Access Control · CWE-306 (Missing Authentication for Critical Function)

Admin & Söhne GmbH and admin-soehne.example are invented.

Fixed, then verified. On retest, not on trust.

After you fix, we test the same finding again, the same way. The report then shows each finding as fixed and verified, with the date and how we checked.

Retest confirmation · Admin & Söhne GmbH · MC-2026-014
Fixed · verified on retestWas: Risk High · CVSS 8.2

Admin area reachable without login

GET /admin HTTP/2
Host: app.admin-soehne.example

HTTP/2 302
Location: /login
Retest
After the fix, with the same method as the test
How verified
/admin now redirects to the login. Tested without a session, with an ordinary customer account and with an expired session.
Result
Access refused in all three cases. Finding closed.

Attestation letter. Proof without the report.

One page you can pass to auditors, customers and insurers: who tested what and when, the scope, the standards, and that the findings were fixed and verified on retest. The confidential report stays with you; the letter confirms our test and is not a certification.

Mr Cyber

Attestation letter

Client
Admin & Söhne GmbH
Tested by
Mr Cyber
Test type
Manual web application penetration test
Scope
app.admin-soehne.example, including /admin
Sequence
Test · retest after the fix
Standards
OWASP WSTG · OWASP Top 10 2021 · CVSS 3.1
Result
11 findings (1 Critical, 2 High, 5 Medium, 3 Low), all fixed and verified on retest. No open findings in scope.

Confirms the test described above. Not a certification.

Findings become tickets. Imported, not retyped.

Every report comes with an import file for Jira, ServiceNow, GitLab, Azure DevOps and GitHub. Helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 receive the tickets by email import. One finding becomes one ticket, with title, severity and priority, affected asset, description, steps to reproduce, recommended fix and references. 30 findings = 30 tickets nobody has to type.

Client portal with triage, status per finding and one-click ticket creationIn development

ProjectsIT Security Operations IT-SECOPS-142

[MC-2026-014] Admin area reachable without login

To Do

Details

Assignee
Unassigned
Reporter
Mr Cyber
Priority
High
Labels
  • pentest
  • security
  • severity-high
  • web
Sprint
None
Issue type
Bug

Description

Finding: MC-2026-014
Severity: High
CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)

Affected asset

  • app.admin-soehne.example · /admin

Description

The administration area at /admin opens without asking for a password. Anyone who types the address sees the full customer list with names, addresses and order history, and can change a few settings such as the shop’s opening notice.

Steps to reproduce

  1. Open a private browser window, without logging in.
  2. Go to https://app.admin-soehne.example/admin.
  3. The admin dashboard loads, showing all customers and edit buttons.
GET /admin HTTP/2
Host: app.admin-soehne.example

HTTP/2 200
<title>Admin Dashboard</title> …

Impact

Anyone on the internet can read all customer data, with no account and no special skill. That is a GDPR data breach that must be reported within 72 hours, plus a letter to every customer. Search engines or automated scanners can find this kind of page within days.

Recommended fix

Protect the whole /admin area with a mandatory login on the server, and require two-factor authentication for admins. Better still, make the admin area reachable only from the company network or VPN. Add an automated test that checks every admin page refuses access without login.

References

  • OWASP Top 10 2021: A01 Broken Access Control
  • CWE-306 (Missing Authentication for Critical Function)
How the finding looks after import into Jira (recreated view).

Request a full report

We email you a complete anonymised report, with no client data.

See my fixed price

Prefer to talk first? Book a call