Autify Digital Ltd Lloyds Cardnet Gateway Security & Risk Analysis

The autifydigital-lloyds-cardnet plugin version 3.0.12 exhibits a mixed security posture. On the positive side, it demonstrates good practices in database interactions, with 100% of SQL queries utilizing prepared statements, and a very high rate of output escaping. The absence of known CVEs and a clean vulnerability history is also a strong indicator of past security diligence. However, significant concerns arise from the attack surface analysis. A notable portion of AJAX handlers (12 out of 27) lack authentication checks, presenting a potential entry point for unauthorized actions if these handlers perform sensitive operations. Furthermore, the taint analysis reveals a high number of flows with unsanitized paths, with 14 identified as high severity. This suggests that user-supplied data may not be adequately validated or sanitized before being used in sensitive operations, potentially leading to vulnerabilities like cross-site scripting (XSS) or server-side request forgery (SSRF) if these flows are exposed via the unprotected AJAX endpoints.