How 2 Researchers Turned Boredom Into a Natl Audit

Two Polish penetration testers explain how they spent their spare time checking the security of public-sector websites in Poland. They begin with the legal question, citing a provision in the Polish penal code that exempts people who test a system to secure it, notify the administrator, and cause no harm, while warning that careless testing can still break things.

The first target was PAD-CMS, a content system used for mandatory public information bulletins. It was end-of-life with no patches, and they showed two unauthenticated remote code execution paths, one of which came from loose comparisons and how PHP handles request arrays. A third path was found by another researcher. Later work found a file manager plugin with default empty credentials, a base64 image upload that accepted PHP code, and a court system where roughly 245 of about 300 courts had vulnerable instances. A web application firewall rule that blocked the admin path could be bypassed with a double slash.

The talk closes with common problems: agencies have no software requirements, end-of-life products stay in service, and vendors sometimes deny or downplay flaws, including calling direct database access from a desktop client a security inconvenience. The speakers report reports to national CERT and ministry bodies covering roughly 10,000 agencies and a quarter million websites over about two years. Their advice is to test responsibly and use these skills for public benefit.