Hi Jagdish,
Thanks for reaching out :) We could definitely use your expertise to
improve on the security of MifosX
I had a quick look at the attached report and many of the listed
vulnerabilities might not exist as we use prepared statements on the server
side to which variables are passed in.
Do you think you would be able to filter and prioritize the vulnerabilities
with injection examples and we can take a stab at fixing them ?
Regards,
Vishwas
P.S: I saw your mail today and suspect most other users on the list might
have missed it too ( for some reason Gmail has marked it as a spam..*Be
careful with this message.* Our systems couldn't verify that this message
was really sent by yahoo.com.)
On 30 December 2014 at 03:52, Jagadish Bidarkoti <
[email protected]> wrote:
> Hi,
>
> I am Jagadish Bidarkoti working for Thomson Reuters as an enterprise
> architect. I have been watching this space quite sometime and always tried
> to contribute, but somehow time was a big constraint.
>
> Security is an important aspect of any application and any ADM, and that
> too for an application deals financials need to be more secure and robust.
>
> Recently I tried to test / penetrate mifos and saw there are more number
> of security vulnerabilities in it in very first level of small tool based
> penetration, such as SQL, XSS etc. Its important this kind of application
> should support these kind of security issues (
> https://www.owasp.org/index.php/Testing_Checklist).
>
> I have attached the report and the documentation around setting up mifos
> and ZAP (security penetration tool).
>
> How to deal / mitigate these issues? i think it's time for secure coding.
> [image:
> *:) happy]
>
> Thanks,
> JB
>
>
>
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming! The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is
> your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net
> _______________________________________________
> Mifos-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mifos-users
>
>
------------------------------------------------------------------------------
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________
Mifos-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mifos-users
