I work for a finance startup managing the technical stuff. The COO decided to create a new web site using a contract developer and the owner of the company paid for it ($9k). I'm asked to use the new site (Joomla + plenty of custom PHP code), but it appears to be of very low quality and insecure. For example:
- It doesn't use source control or a framework.
- It doesn't use MVC. The PHP source files are 30k - 98k in size. They embed HTML, CSS, PHP, JS into one file.
- It uses the session id as an email verification token, allowing anyone who eavesdrops the email to hijack the session.
- It doesn't use salts in the passwords.
$hashedPassword = hash('sha256', $_POST['form_pswd']);
- It doesn't escape user input in SQL queries.
WHERE u_password='".$hashedPassword."' && u_username='".$_POST["username"]."'");
- It doesn't encrypt personal information or financial information.
- It doesn't escape user input in HTML output.
<input placeholder='Name' type='text' name='form_name' value='".$row["profile_name"]."'
- The database password is hardcoded in the source code.
$mysqli = new mysqli("localhost", ...
- The CRUD design does not even have R-Read. There is no display of user info that is entered! I asked to make sure I wasn't missing something. The demo used a sham wrapper of a static CMS page. This is interpreted as "poking holes in it".
- It has 7 vulnerabilities according to a security scanning app, including XSS and clickjacking. I've shown the report.
I'm certain it's only a matter of time before it's hacked and I don't want my name on it. So I've tried to warn against it. Unfortunately the COO seems to have made his mind and believes my position is a personal issue. Most of my co-workers are non-technical and none has development skills, so nobody spotted the real issue.
How can I explain the boss/owner that it's not OK to use such an insecure and unmaintainable software, when the reasons are technical but knowing he spent a lot of money on it ?
Regardless of the objective arguments, I figure my options are:
- State the facts and walk away.
- Try to explain why it's bad. If success, continue with old Ruby on Rails site. If fail, walk away.
- Try to fix the code myself. I dread this as it's very messy. It could take longer than expected.
- Make the old site look like the new site. The new site does have nice design elements I can copy. Even though no one may know the difference, this option seems a bit disingenuous.