Lexception

The Problem

Before engaging Bugstrix, L’Exception relied on occasional automated security scans. Automated scanners catch known CVEs – they do not catch business logic flaws, authentication bypasses, or chained vulnerabilities that require a human attacker’s thinking. The specific risks facing the platform included:

• Customer account takeover via authentication weaknesses
• Payment flow manipulation through business logic abuse
• Data exposure via Insecure Direct Object References (IDOR)
• Injection attacks targeting search, filter, and product database queries
• Session hijacking through JWT implementation flaws
• Admin panel exposure through privilege escalation paths

The Engagement: What Bugstrix Actually Did

Continuous Manual Penetration Testing

Bugstrix conducted ongoing black-box, grey-box, and white-box assessments across the full platform:

• Full web application testing across all user-facing surfaces
• API endpoint testing – authentication, authorisation, rate limiting, data exposure
• Payment gateway and checkout flow security assessment
• User account management – registration, login, password reset, session handling
• Admin panel and back-office access controls
• Third-party integration security review and GDPR compliance posture validation

Bug Bounty Program Design and Management

Bugstrix designed, launched, and fully managed both private and public bug bounty programs on behalf of L’Exception, including:

• Scope definition and rules of engagement
• Researcher briefing, onboarding, and report triage
• Duplicate filtering across researcher submissions
• Bounty negotiation with researchers on behalf of the client
• Coordinating fix timelines with L’Exception’s development team
• Retest and validation of all remediated vulnerabilities

Vulnerabilities Discovered

Insecure Direct Object Reference (IDOR)

Attackers could manipulate object identifiers in API requests to access other customers’ order histories, personal data, and saved payment methods – enabling mass data exfiltration without authentication.

SQL Injection

Multiple injection points discovered in search, filtering, and product query parameters. A successful attack can expose an entire customer database – names, addresses, hashed passwords, and payment references.

Cross-Site Scripting (XSS)

Both reflected and stored XSS vulnerabilities identified across product review forms, search inputs, and user profile fields. Stored XSS can be weaponised to steal session cookies from thousands of users.

JWT (JSON Web Token) Attacks

Flaws in the JWT implementation allowed token manipulation that could escalate privileges or impersonate other users – bypassing authentication entirely.

Account Takeover Vectors

Weak password reset flows, missing rate limiting, and brute-force vulnerabilities created multiple paths to full account takeover including admin accounts.

Business Logic Vulnerabilities

Pricing manipulation flaws, discount abuse vectors, and checkout flow bypasses that could have been exploited for financial fraud – invisible to automated scanners.

Results

Client Testimonial

We have been working with Bugstrix since 2021 and they have greatly helped us upgrade our website safety. Bugstrix is definitely a trustworthy partner for everything related to bugs and vulnerabilities.
– Régis Pennel, Founder, L’Exception

Key Takeaways for Small E-Commerce Businesses

• One-time audits are not enough – your platform changes every sprint, and so does the threat landscape.
• Automated scanners miss the most dangerous vulnerabilities: business logic flaws, IDOR, and chained attacks.
• Bug bounty programs need management to work – an unmanaged program creates noise, frustration, and legal risk.