Revealing the hidden vulnerabilities of an educational institution's ERP system: facing risk

Abstract

Introduction: The inappropriate use of information and communication technology tools leads to serious consequences, such as information theft, identity theft, and the commission of cybercrimes, among others. One of the main concerns lies in the use of these tools in the educational field. The improper use of web applications can result in significant losses for companies, such as reputation damage, loss of market share, or lack of competitiveness. Objective: Conduct a vulnerability analysis to identify threats and exposures that the ERP system of a Higher Education Institution may be susceptible to. Methodology: A comprehensive vulnerability analysis was carried out concerning the ERP web platform using useful tools hosted on Kali Linux. These vulnerabilities were evaluated based on their degree of criticality, considering their potential impact on confidentiality, integrity, and availability (CIA), using an unauthenticated analysis topology. Results: A total of 36 identified vulnerabilities are presented, excluding "log" type vulnerabilities. Additionally, a thorough analysis of the web page's security configuration structure is conducted. Conclusion: The comprehensive enumeration of vulnerabilities and deficiencies in the configuration provides a solid foundation for enhancing the security of the ERP system. This information enables the implementation of corrective measures and the application of appropriate protective measures to mitigate the identified risks, these measures would be even more effective with an authenticated topology analysis.