Security Analysis of UBC Web Applications (November 2007)
Jeffrey Qian, Je-Yu George Lee, William Nguyen Ha · 2007
UBC Web applications and online services are used by thousands of students and faculty members on a daily basis. How secure are these applications? In this report, we have analyzed security threat levels from sixteen UBC websites, and classified the threads found. A few vulnerabilities discovered are demonstrated for illustration purposes only and no real damage has been done to the web server and applications. However, these vulnerabilities that are found could facilitate other attackers to perform further actions and eventually compromise the system. Countermeasures and recommendations are provided in this report and will be forwarded to appropriate departments in UBC. Index Terms Web Application Security, Structure Query Language, SQL, Relational Database Management System, RDBMS, Cross Site Scripting, XSS, SQL Injection, Directory Traversal