TITAN AI - Enterprise Application TIER - LIVE PROOF

Detector: crm_shield.sqli_parameter_scan
The contact search endpoint accepts unsanitized user input in the q query parameter and passes it directly to the underlying SQL query without parameterization. Injecting ' OR 1=1 -- returns the full contact database. This allows an attacker to exfiltrate all CRM contact records including email addresses, phone numbers, and deal values.

Detector: erp_guard.default_credential_audit
The ERP production instance at titan-erp-core.azurewebsites.net is accessible using the default administrator username admin with the factory-set password. The authentication configuration shows no password rotation policy and no MFA enforcement for admin-level accounts. This allows any attacker with knowledge of the default credentials to gain full administrative control over the ERP system including financial modules, inventory, and procurement.

Detector: hcm_shield.payroll_exposure_scan
The payroll export endpoint at /api/payroll/export returns full employee compensation data including salary, SSN last-4, bank routing numbers, and tax withholding details without requiring any authentication token. The endpoint was added during a recent sprint and the authentication middleware was not applied. Unauthenticated GET requests return JSON payloads containing PII for all active employees.

Detector: fin_guard.journal_entry_integrity
The financial ledger database grants UPDATE and DELETE permissions on the journal_entries table to the application service principal. This allows any user with application-level access to modify or delete posted journal entries without an approval workflow. Audit logs show 14 direct modifications to closed-period entries in the last 30 days with no corresponding approval records. This violates segregation of duties and creates material risk of financial statement manipulation.

Detector: crm_shield.oauth_token_storage_audit
The CRM single-page application stores OAuth 2.0 access tokens and refresh tokens in browser localStorage as plaintext JSON. This storage mechanism is vulnerable to XSS-based token theft because any JavaScript executing in the page context can read localStorage. The refresh token has a 90-day lifetime, giving an attacker persistent access to the CRM API after a single successful XSS exploitation.

Detector: crm_shield.webhook_validation_scan
The CRM inbound webhook endpoint at /api/webhooks/inbound processes incoming payloads without validating HMAC signatures or verifying the source IP address. Any external party can POST crafted payloads to create, modify, or delete CRM records including deals, contacts, and pipeline stages. No origin allowlist or signature verification is configured in the App Service or application code.

Detector: erp_guard.file_upload_restriction_scan
The ERP document upload endpoint accepts files with any extension including .exe, .ps1, .bat, .dll, and .aspx. Files are stored in an Azure Blob container mapped to the web root with execute permissions. An attacker can upload a web shell disguised as a document attachment and achieve remote code execution on the App Service instance. No antimalware scanning is applied to uploaded files.

Detector: erp_guard.session_timeout_policy
The ERP application session cookie has a max-age of 86400 seconds (24 hours) with no idle timeout configured. Once a user authenticates, their session remains valid for a full day regardless of inactivity. Combined with the absence of session binding to client IP or user agent, a stolen session cookie provides persistent access to financial and procurement modules for up to 24 hours.

Detector: hcm_shield.rbac_privilege_escalation
The HCM application grants the HR_Analyst role write access to the /api/compensation/adjustments endpoint. This role is intended for reporting and analytics only, but the RBAC configuration grants full CRUD permissions on compensation records. 23 users hold this role, any of whom can modify salary data, bonus allocations, and equity grants without manager approval. Audit logs show 3 unauthorized compensation adjustments in the last 60 days that bypassed the standard approval workflow.

Detector: secure_code.sast_credential_leak
Static analysis of the ERP application configuration reveals a hardcoded SQL Server connection string containing the sa username and plaintext password embedded in appsettings.json. This connection string is checked into the application repository and visible to all developers with repo access. The sa account has sysadmin privileges on the database server, providing unrestricted access to all databases including financial ledger, inventory, and HR data.

Detector: sentinel.app_logging_compliance
Application-level logging is disabled on the CRM App Service. HTTP request logs, application error logs, and detailed error messages are not being captured. The diagnostic settings show httpLoggingEnabled: false and detailedErrorLoggingEnabled: false. Without application logging, security incidents involving the CRM cannot be investigated, SLA compliance cannot be verified, and anomalous access patterns cannot be detected.

Detector: scout.tls_version_audit
The ERP App Service is configured with minTlsVersion: 1.0 allowing clients to negotiate TLS 1.0 and TLS 1.1 connections. These protocol versions have known vulnerabilities including BEAST, POODLE, and CRIME attacks that allow an attacker to decrypt traffic in transit. Financial transaction data, procurement orders, and employee records transmitted over TLS 1.0 connections are at risk of interception.

Detector: comply.data_retention_policy_check
The HCM database contains employee PII records dating back to 2019 with no automated retention or purge policy configured. Former employee records including SSN, home address, emergency contacts, and performance reviews remain in the active database indefinitely. No data retention policy is defined in Azure SQL, and no scheduled purge job exists. Under GDPR Article 17 and state privacy laws, organizations must delete personal data when it is no longer necessary for the original processing purpose.

Detector: predict.anomaly_detection_v3
Behavioral analysis detected a 340% increase in bulk data export requests from the CRM portal over the last 72 hours compared to the 30-day rolling baseline. A single service account svc-crm-integration executed 847 export requests averaging 12MB each, totaling approximately 10.1GB of contact and deal data extracted. The export pattern deviates from the established baseline of 50 exports per day and suggests either compromised credentials or an insider threat scenario.

Detector: forge.cors_policy_audit
The financial reporting application has CORS configured with Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true. This combination allows any website to make authenticated cross-origin requests to the financial reporting API, enabling an attacker to craft a malicious page that reads financial statements, account balances, and transaction data from an authenticated user's browser session. The wildcard origin combined with credentials is explicitly flagged by the OWASP CORS misconfiguration guidance.