SQL Injection to PII Exposure: Securing a Consumer SaaS Platform Under Mexican Data Protection Law
Client: A SaaS platform provider serving consumer-facing and franchise businesses in Mexico (name withheld under client confidentiality)
15
Validated findings across the platform
3 Critical
Vulnerabilities enabling unauthorized database access & PII exposure
91%
Initial risk score recorded, reflecting confirmed critical exposure
The challenge
This client operates a SaaS platform serving consumer-facing and franchise business customers across Mexico, handling personal data subject to LFPDPPP, Mexico's federal data protection law. Ahead of scaling its client onboarding, it engaged Eiferone for a full external security audit and penetration test.
The approach
The engagement combined the OWASP Web Security Testing Guide and the Penetration Testing Execution Standard, assessing application logic, perimeter protection, and regulatory exposure under LFPDPPP.
What we found
Testing confirmed a time-based blind SQL injection in a data-submission endpoint, verified by measuring artificial response delays the team could trigger on demand, direct proof the database engine was executing injected commands. A second, tautology-based injection point allowed outright data exfiltration rather than blind inference. Separately, a broken access control issue let an authenticated user manipulate a resource identifier to view records belonging to other customers, exposing personal data with no authorization check in place. A high-severity finding showed that although the application sat behind a CDN-based web application firewall, its origin server was directly reachable by IP address, letting testers bypass the WAF entirely and send unfiltered traffic straight to the backend, undermining every perimeter control the client had paid for. Medium findings included a PHP runtime years past end-of-life, a web-server misconfiguration that let one subdomain's traffic be routed to another via a spoofed request header, an administrative login reachable from the open internet behind only a password, a client-side-only automation limit the backend didn't enforce, missing baseline HTTP security headers, and a known-vulnerable frontend JavaScript library used in a way that could enable DOM-based cross-site scripting. Low findings included a single-page application that kept serving its full compiled bundle, revealing internal route and component names, on invalid URLs, weak legacy transport security, and a missing DMARC policy.
The outcome
Given the confirmed database-level exposure of personal data, Eiferone flagged both SQL injection findings and the access-control issue as immediate, same-week priorities, alongside closing the WAF-bypass path by restricting the origin server to only accept traffic from the CDN. The remediation roadmap also mapped each finding to the specific LFPDPPP articles it implicated, to support the client's own regulatory risk reporting.