Hardened, but not finished: a high-value transaction app

The challenge

A bank asked for a gray-box test of a payment-operations web application from the perspective of its highest standard administrative role.

How it unfolded

1. Tested from the highest standard admin role (gray-box).
2. Confirmed the core controls — injection resistance, object authorization — were genuinely solid.
3. Found a routine profile field exported as a live spreadsheet formula, executing on whoever opened the export.
4. Found a role labelled benign “self-service profile” that actually granted full user and role administration.
5. Found high-impact payment-engine operations (date roll, resend, suspend, routing, start/stop) with no maker/checker approval.

Impact

Strong technical defences were undercut by segregation-of-duties gaps that would let one insider — or one compromised operator — move or stop payments unilaterally.

Outcome

Sixteen findings centred on segregation of duties, role-label accuracy and safe data export, giving the bank a concrete path to second-actor approval and least-privilege role redesign in a high-value payment environment.