{"grade":{"score":70,"letter":"C","breakdown":{"cap_applied":null,"inferred_penalty":14,"confirmed_penalty":16,"inferred_penalty_capped":false}},"vault":{"version":"2026.08.2","released":"2026-08-05"},"schema":"magekwik.scan\/4","target":{"host":"autosparks.co.uk","port":443,"origin":"https:\/\/autosparks.co.uk","scheme":"https","base_path":""},"findings":[{"title":"Appears exposed to SessionReaper (CVE-2025-54236) if unpatched","summary":"Store appears to be running Magento 2.x. If it is 2.4.8-p2 or earlier without the APSB25-88 emergency hotfix (VULN-32437), an unauthenticated improper-input-validation flaw in the Commerce REST API allows customer-session takeover and, under certain configurations, remote code execution. This is actively exploited in the wild \u2014 verify the exact patch level urgently. CVE-2025-54236 is on CISA's Known Exploited Vulnerabilities catalog \u2014 it is being exploited in the wild right now, so treat patching as urgent, not theoretical.","evidence":{"facts":{"form_key":"present","mage_init":"present","page_wrapper":"present","section_data":"present","mage_translate":"present","magento_header":"X-Magento-Cache-Debug","requirejs_mage":"present","x-magento-init":"present","inferred_branch":"2.x","magento_modules":"present","static_frontend":"present","static_version_path":"present"},"snippet":null,"observed_url":"https:\/\/autosparks.co.uk\/"},"probe_id":"cve_signatures","severity":"critical","confidence":"inferred","remediation":{"steps":[{"command":"bin\/magento setup:upgrade && bin\/magento cache:flush","description":"Apply the APSB25-88 isolated hotfix (VULN-32437) for your release line \u2014 it closes this without a full upgrade \u2014 then rebuild."},{"command":"bin\/magento admin:user:unlock; # then flush the session store to force re-authentication","description":"If there is any sign of exploitation, assume session\/admin compromise: invalidate all sessions and rotate admin credentials and integration tokens."},{"command":"composer require magento\/product-<your-edition>-edition:<fixed-version> --no-update && composer update","description":"Optional: move to a patched release on your line. Use your edition's metapackage and the exact fixed version from the advisory."}],"summary":"Apply Adobe's APSB25-88 emergency hotfix (VULN-32437) immediately, then rebuild. Actively exploited \u2014 treat as urgent, not routine.","reference":"https:\/\/helpx.adobe.com\/security\/products\/magento\/apsb25-88.html"}},{"title":"Full REST API schema publicly disclosed","summary":"The complete REST schema is served without authentication, enumerating every service \u2014 including custom modules \u2014 and giving an attacker the full API map to probe.","evidence":{"facts":{"bytes":"113158","endpoint":"\/rest\/all\/schema?services=all"},"snippet":null,"observed_url":"https:\/\/autosparks.co.uk\/rest\/all\/schema?services=all"},"probe_id":"rest_api","severity":"medium","confidence":"confirmed","remediation":{"steps":[{"command":"location ~* ^\/rest\/(all|default)\/schema { deny all; return 404; }","description":"Block the schema endpoint at the edge (legitimate clients do not need it)."},{"command":null,"description":"Rate-limit \/rest and require authentication for non-guest resources."}],"summary":"Restrict schema\/API discovery in production.","reference":"https:\/\/developer.adobe.com\/commerce\/webapi\/rest\/"}},{"title":"Older critical CVEs on this branch \u2014 verify your patch level","summary":"The store appears to be running Magento 2.x, but the exact patch level could not be determined. This branch has had critical, now-fixed vulnerabilities \u2014 CosmicSting (CVE-2024-34102, APSB24-40); TrojanOrder (CVE-2022-24086, APSB22-12). A store kept reasonably current already has these patches; if yours is NOT on the latest patch they are critical (unauthenticated RCE \/ data theft), and 2 are on CISA's Known Exploited Vulnerabilities catalog (actively exploited in the wild). Confirm your exact patch level.","evidence":{"facts":{"form_key":"present","mage_init":"present","older_cves":"CVE-2024-34102, CVE-2022-24086","page_wrapper":"present","section_data":"present","mage_translate":"present","magento_header":"X-Magento-Cache-Debug","requirejs_mage":"present","x-magento-init":"present","inferred_branch":"2.x","magento_modules":"present","static_frontend":"present","static_version_path":"present"},"snippet":null,"observed_url":"https:\/\/autosparks.co.uk\/"},"probe_id":"cve_signatures","severity":"medium","confidence":"inferred","remediation":{"steps":[{"command":"bin\/magento --version","description":"Check the running version against the latest patch for your line."},{"command":"composer update && bin\/magento setup:upgrade && bin\/magento cache:flush","description":"If behind, apply the latest security patches (isolated hotfixes exist for each of these), then rebuild."}],"summary":"Confirm the store is on the latest patch for its release line.","reference":"https:\/\/experienceleague.adobe.com\/docs\/commerce-operations\/release\/planning\/lifecycle-policy.html"}},{"title":"SPF discloses direct server IPs (possible WAF\/CDN bypass)","summary":"Your SPF record publishes 3 literal IP address(es) (198.37.154.193, 212.84.164.81, 161.35.160.48). These are often the self-hosted origin. If your storefront is fronted by a WAF\/CDN but the origin is reachable at one of these, an attacker connects to it directly and the WAF is decorative. Confirm the origin only accepts traffic from your CDN.","evidence":{"facts":{"count":"3","domain":"autosparks.co.uk","spf_ips":"198.37.154.193, 212.84.164.81, 161.35.160.48"},"snippet":null,"observed_url":null},"probe_id":"mail_auth","severity":"medium","confidence":"inferred","remediation":{"steps":[{"command":null,"description":"Restrict the origin to accept HTTP only from your CDN\/WAF IP ranges (e.g. Cloudflare Authenticated Origin Pulls or an IP allowlist)."},{"command":null,"description":"Send mail from a dedicated relay\/IP that is not the web origin, so SPF never discloses the origin address."}],"summary":"Keep the mail-sending IPs separate from the web origin, and firewall the origin to your CDN.","reference":null}},{"title":"DMARC policy is monitor-only (p=none)","summary":"DMARC is published but the policy is p=none \u2014 it reports but does NOT block spoofed mail. Once your legitimate senders are aligned, move to quarantine, then reject.","evidence":{"facts":{"dmarc":"v=DMARC1; p=none"},"snippet":null,"observed_url":null},"probe_id":"mail_auth","severity":"low","confidence":"confirmed","remediation":{"steps":[{"command":"_dmarc  TXT  \"v=DMARC1; p=none; rua=mailto:dmarc@yourdomain\"","description":"Start in monitor mode to collect reports:"},{"command":"_dmarc  TXT  \"v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain\"","description":"Once SPF\/DKIM pass for all legitimate mail, enforce it:"}],"summary":"Publish a DMARC policy and tighten it once aligned.","reference":"https:\/\/datatracker.ietf.org\/doc\/html\/rfc7489"}},{"title":"SOAP WSDL service list publicly accessible","summary":"The SOAP WSDL list is reachable, enumerating available SOAP services and operations.","evidence":{"facts":{"endpoint":"\/soap\/default?wsdl_list=1"},"snippet":null,"observed_url":"https:\/\/autosparks.co.uk\/index.php\/soap\/default?wsdl_list=1"},"probe_id":"rest_api","severity":"low","confidence":"confirmed","remediation":{"steps":[{"command":"location ~* ^\/(index.php\/)?soap { deny all; return 404; }","description":"Block the SOAP endpoint at the edge."}],"summary":"Disable SOAP if unused, or restrict the endpoint.","reference":null}},{"title":"Appears to be running Magento 2.x","summary":"Platform inferred from passive signals. Treat the version as approximate \u2014 verify the exact patch level against the deployment.","evidence":{"facts":{"form_key":"present","mage_init":"present","page_wrapper":"present","section_data":"present","mage_translate":"present","magento_header":"X-Magento-Cache-Debug","requirejs_mage":"present","x-magento-init":"present","magento_modules":"present","static_frontend":"present","static_version_path":"present"},"snippet":null,"observed_url":"https:\/\/autosparks.co.uk\/"},"probe_id":"version_fingerprint","severity":"info","confidence":"inferred","remediation":null},{"title":"Permissions-Policy not set","summary":"No Permissions-Policy. Powerful browser features are not explicitly restricted for embedded third-party content.","evidence":{"facts":{"Permissions-Policy":"absent"},"snippet":null,"observed_url":"https:\/\/autosparks.co.uk\/"},"probe_id":"security_headers","severity":"info","confidence":"confirmed","remediation":{"steps":[{"command":"add_header Permissions-Policy \"geolocation=(), camera=(), microphone=()\" always;","description":"nginx: restrict sensitive features."}],"summary":"Declare a least-privilege Permissions-Policy.","reference":null}}],"compliance":[{"ref":"6.4.3","note":"We rendered the checkout page and inventoried its scripts with no unmanaged third-party script found, but a complete 6.4.3 inventory of the authenticated payment step needs a full checkout walk we do not perform passively.","title":"Payment-page scripts are managed and authorised","status":"review","signals":[],"framework":"PCI DSS 4.0.1","requirement":"Every script loaded on the payment page must be inventoried, justified\/authorised, and its integrity assured (e.g. SRI or CSP)."},{"ref":"11.6.1","note":"A one-off external scan cannot verify ongoing change detection \u2014 this requires continuous, scheduled monitoring of the payment page.","title":"Unauthorised change detection on payment pages","status":"not_assessed","signals":[],"framework":"PCI DSS 4.0.1","requirement":"Detect and alert on unauthorised changes to payment-page HTTP headers and script content, at least every seven days."},{"ref":"6.3.3","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Known vulnerabilities are patched","status":"gap","signals":["Appears exposed to SessionReaper (CVE-2025-54236) if unpatched","Older critical CVEs on this branch \u2014 verify your patch level"],"framework":"PCI DSS 4.0.1","requirement":"Install applicable security patches; address critical vulnerabilities promptly."},{"ref":"4.2.1","note":"The checks observable from outside passed. This is not a certification.","title":"Strong cryptography for data in transit","status":"ok","signals":[],"framework":"PCI DSS 4.0.1","requirement":"Use strong cryptography and secure protocols to protect cardholder data over open networks."},{"ref":"2.2.1","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Secure configuration; no unnecessary exposure","status":"gap","signals":["Full REST API schema publicly disclosed","SOAP WSDL service list publicly accessible"],"framework":"PCI DSS 4.0.1","requirement":"Harden system configuration and remove or restrict unnecessary services, files, and information disclosure."},{"ref":"GDPR Art. 32","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Security of processing (personal data)","status":"gap","signals":["Appears exposed to SessionReaper (CVE-2025-54236) if unpatched","Older critical CVEs on this branch \u2014 verify your patch level"],"framework":"UK GDPR \/ PECR","requirement":"Appropriate technical measures to protect customer personal data \u2014 encryption, resilience, and preventing unauthorised access."},{"ref":"PECR reg. 6","note":"We render the landing page and flag any tracker that fires before consent; none was caught here, but a passive load cannot audit every template, so we do not certify consent compliance either way.","title":"Consent before non-essential cookies","status":"not_assessed","signals":[],"framework":"UK GDPR \/ PECR","requirement":"Non-essential cookies (analytics, marketing, tag managers) must not be set before the visitor consents."}],"started_at":1790119795.956965,"duration_ms":16874,"finished_at":1790119812.830973,"engine_version":"1.0.0","probe_outcomes":[{"error":null,"status":"completed","probe_id":"waf","probe_name":"WAF \/ CDN scanner blocking","duration_ms":147,"findings_count":0},{"error":null,"status":"completed","probe_id":"version_fingerprint","probe_name":"Platform and version fingerprint","duration_ms":1546,"findings_count":1},{"error":null,"status":"completed","probe_id":"static_fingerprint","probe_name":"Static-asset version fingerprint","duration_ms":1399,"findings_count":0},{"error":null,"status":"completed","probe_id":"security_headers","probe_name":"Security response headers","duration_ms":1,"findings_count":1},{"error":null,"status":"completed","probe_id":"graphql_introspection","probe_name":"GraphQL introspection","duration_ms":717,"findings_count":0},{"error":null,"status":"completed","probe_id":"cve_signatures","probe_name":"CVE signatures (inferred)","duration_ms":0,"findings_count":2},{"error":null,"status":"completed","probe_id":"cookie_flags","probe_name":"Cookie security flags","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"tls_config","probe_name":"TLS configuration and certificate","duration_ms":45,"findings_count":0},{"error":null,"status":"completed","probe_id":"leaked_keys","probe_name":"Leaked keys in JavaScript","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"magecart_heuristics","probe_name":"Magecart \/ skimmer heuristics","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"media_listing","probe_name":"Media directory listing","duration_ms":2202,"findings_count":0},{"error":null,"status":"completed","probe_id":"default_admin_path","probe_name":"Default admin path","duration_ms":1520,"findings_count":0},{"error":null,"status":"completed","probe_id":"release_matrix","probe_name":"Adobe release-matrix status","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"robots_sitemap","probe_name":"robots.txt \/ sitemap disclosure","duration_ms":1468,"findings_count":0},{"error":null,"status":"completed","probe_id":"server_header","probe_name":"Server software disclosure","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"frontend_stack","probe_name":"Frontend stack","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"rss_leak","probe_name":"Public RSS feed leakage","duration_ms":2268,"findings_count":0},{"error":null,"status":"completed","probe_id":"rest_api","probe_name":"REST\/SOAP API disclosure","duration_ms":1460,"findings_count":2},{"error":null,"status":"completed","probe_id":"admin_tools","probe_name":"Exposed admin \/ database tools","duration_ms":3719,"findings_count":0},{"error":null,"status":"completed","probe_id":"mail_auth","probe_name":"Email authentication (SPF \/ DMARC)","duration_ms":70,"findings_count":2},{"error":null,"status":"completed","probe_id":"ct_subdomains","probe_name":"Certificate Transparency exposure","duration_ms":128,"findings_count":0},{"error":null,"status":"completed","probe_id":"payment_page_scripts","probe_name":"Payment-page script inventory (PCI 6.4.3)","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"consent_timing","probe_name":"Cookie consent timing (PECR \/ GDPR)","duration_ms":0,"findings_count":0}],"severity_counts":{"low":2,"high":0,"info":2,"medium":3,"critical":1},"audit":[{"id":"version_disclosure","name":"Magento version disclosure","status":"secure","category":"Version & CVEs","severity":null,"finding_title":null},{"id":"cve_cosmicsting","name":"CosmicSting (CVE-2024-34102)","status":"needs_verification","category":"Version & CVEs","severity":"medium","finding_title":"Older critical CVEs on this branch \u2014 verify your patch level"},{"id":"cve_trojanorder","name":"TrojanOrder (CVE-2022-24086)","status":"needs_verification","category":"Version & CVEs","severity":"medium","finding_title":"Older critical CVEs on this branch \u2014 verify your patch level"},{"id":"supee_patches","name":"SUPEE security patches","status":"secure","category":"Version & CVEs","severity":null,"finding_title":null},{"id":"release_support","name":"Supported release \/ end-of-life","status":"secure","category":"Version & CVEs","severity":null,"finding_title":null},{"id":"exp_envphp","name":"app\/etc\/env.php","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_localxml","name":"app\/etc\/local.xml (Magento 1)","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_dotenv","name":".env file","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_git","name":".git repository","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_svn","name":".svn metadata","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_composer","name":"composer.lock","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_sbom","name":"composer.lock SBOM (exact versions + modules)","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_configphp","name":"app\/etc\/config.php","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_setup","name":"Setup \/ upgrade application","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_downloader","name":"Legacy downloader","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_phpinfo","name":"phpinfo() page","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_varlog","name":"var\/log exposure","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_releasenotes","name":"RELEASE_NOTES.txt","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_puberrors","name":"pub\/errors config","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"media_listing","name":"Media directory listing","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"mal_named","name":"Known malware signatures (Visbot \/ Gurulnc)","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"mal_badscript","name":"Known-bad script domains","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"mal_obfuscated","name":"Obfuscated JavaScript","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"mal_leakedkeys","name":"Leaked keys in JavaScript","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"data_rss_order","name":"Public order RSS feed","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"data_rss_stock","name":"Public stock RSS feed","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"data_rest_schema","name":"REST API schema disclosure","status":"at_risk","category":"Data exposure","severity":"medium","finding_title":"Full REST API schema publicly disclosed"},{"id":"data_soap","name":"SOAP WSDL disclosure","status":"at_risk","category":"Data exposure","severity":"low","finding_title":"SOAP WSDL service list publicly accessible"},{"id":"data_graphql","name":"GraphQL introspection","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"data_robots","name":"robots.txt \/ sitemap disclosure","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"hdr_csp","name":"Content-Security-Policy","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"hdr_hsts","name":"Strict-Transport-Security (HSTS)","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"hdr_xfo","name":"Clickjacking (X-Frame-Options)","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"hdr_nosniff","name":"X-Content-Type-Options","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"hdr_referrer","name":"Referrer-Policy","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"hdr_permissions","name":"Permissions-Policy","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"cookie_secure","name":"Cookie Secure flag","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"cookie_httponly","name":"Cookie HttpOnly flag","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"cookie_samesite","name":"Cookie SameSite","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"tls_config","name":"TLS certificate & protocol","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"server_disclosure","name":"Server software disclosure","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"access_admin","name":"Default admin path","status":"secure","category":"Access surface","severity":null,"finding_title":null},{"id":"access_admintools","name":"Exposed admin tools (Magmi, Adminer)","status":"secure","category":"Access surface","severity":null,"finding_title":null},{"id":"access_frontend","name":"Frontend stack detection","status":"secure","category":"Access surface","severity":null,"finding_title":null},{"id":"mail_spf","name":"SPF record","status":"needs_verification","category":"Email & exposure","severity":"medium","finding_title":"SPF discloses direct server IPs (possible WAF\/CDN bypass)"},{"id":"mail_dmarc","name":"DMARC (spoofing \/ deliverability)","status":"at_risk","category":"Email & exposure","severity":"low","finding_title":"DMARC policy is monitor-only (p=none)"},{"id":"ct_subdomains","name":"Subdomain exposure (Certificate Transparency)","status":"secure","category":"Email & exposure","severity":null,"finding_title":null}]}