+-----------------------------------------------------------------------------------+
|                           DUAL-AUDIENCE REPORT DESIGN                             |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  [ AUDIENCE 1: EXECUTIVE LEADERSHIP (C-Suite, Directors, Board of Directors) ]   |
|  - Core Question: "What is our business risk and financial/operational impact?"   |
|  - Language: Plain business language, risk charts, heatmaps, budget implications  |
|  - Content: Executive Summary, Overall Risk Posture, High-Level Roadmap           |
|                                                                                   |
|  [ AUDIENCE 2: TECHNICAL STAKEHOLDERS (Devs, Sysadmins, SecOps, DevOps) ]        |
|  - Core Question: "Where is the bug, how was it exploited, and how do we fix it?" |
|  - Language: Precise technical terminology, code snippets, network packets, CVEs  |
|  - Content: Detailed Findings, PoC Reproduction Steps, Remediation Code Examples  |
+-----------------------------------------------------------------------------------+

1. Document Information & Non-Disclosure Notice
2. Executive Summary
   ├── 2.1 Engagement Overview & Context
   ├── 2.2 Overall Security Posture & Scorecard
   └── 2.3 Key Strengths & Critical Findings Summary
3. Scope & Rules of Engagement (RoE)
   ├── 3.1 In-Scope IP Addresses / Domains / Web Applications
   └── 3.2 Out-of-Scope Assets & Operational Constraints
4. Assessment Methodology & Frameworks (PTES, OWASP WSTG, OSSTMM)
5. Vulnerability Severity Ratings Matrix (CVSS v3.1 Thresholds)
6. Detailed Technical Findings (Structured Finding Anatomy)
7. Prioritized Remediation Roadmap (Immediate, Medium-Term, Long-Term)
8. Appendices (Raw Tool Outputs, Scan Logs, Terminology Glossary)

+-----------------------------------------------------------------------------------+
|                     8-POINT TECHNICAL FINDING ANATOMY                             |
+-----------------------------------------------------------------------------------+
|  1. UNIQUE FINDING ID & DESCRIPTIVE TITLE (e.g., FIND-01: SQL Injection)         |
+-----------------------------------------------------------------------------------+
|  2. SEVERITY RATING & CVSS v3.1 SCORE / VECTOR STRING                             |
+-----------------------------------------------------------------------------------+
|  3. VULNERABILITY CLASSIFICATION (CVE, CWE Taxonomy Identifiers)                 |
+-----------------------------------------------------------------------------------+
|  4. AFFECTED ASSET(S) (Exact Hostname, IP Address, Port, URL, Parameter)          |
+-----------------------------------------------------------------------------------+
|  5. TECHNICAL DESCRIPTION & ROOT CAUSE ANALYSIS                                   |
+-----------------------------------------------------------------------------------+
|  6. PROOF OF CONCEPT (PoC) & STEP-BY-STEP REPRODUCTION WALKTHROUGH                |
+-----------------------------------------------------------------------------------+
|  7. TECHNICAL & BUSINESS IMPACT EVALUATION                                        |
+-----------------------------------------------------------------------------------+
|  8. ACTIONABLE REMEDIATION GUIDANCE & CODE/CONFIG EXAMPLES                        |
+-----------------------------------------------------------------------------------+

================================================================================
FINDING ID:          SEC-2026-001
TITLE:               Unauthenticated SQL Injection in Authentication Endpoint
SEVERITY:            CRITICAL (CVSS: 9.8)
CVSS v3.1 VECTOR:    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CLASSIFICATION:      CWE-89: Improper Neutralization of Special Elements used in an
                     SQL Command ('SQL Injection')
AFFECTED ASSET:      https://portal.target.com/api/v1/auth/login (Parameter: `username`)

1. TECHNICAL DESCRIPTION:
The login endpoint fails to parameterize or sanitize user input supplied in the
`username` JSON field. The input is directly concatenated into a dynamic SQL query
executed by the backend PostgreSQL database server.

2. PROOF OF CONCEPT (REPRODUCTION STEPS):
Step 1: Intercept the login POST request using an intercepting proxy.
Step 2: Submit the following crafted payload in the `username` field:
        Payload: admin' OR '1'='1' --

Raw Request:
POST /api/v1/auth/login HTTP/1.1
Host: portal.target.com
Content-Type: application/json

{"username": "admin' OR '1'='1' --", "password": "arbitrary_password"}

Raw Response:
HTTP/1.1 200 OK
Content-Type: application/json

{"status": "success", "token": "eyJuYW1la...[REDACTED_JWT]...", "role": "admin"}

Step 3: Note that administrative access was granted without supplying a valid password.

3. IMPACT ANALYSIS:
An unauthenticated remote attacker can completely bypass authentication, retrieve all
customer financial records (Confidentiality), alter system data (Integrity), or drop
database tables (Availability).

4. REMEDIATION GUIDANCE:
Refactor the backend query to use Prepared Statements (Parameterized Queries). Ensure
all input parameters are treated strictly as data literals.

Remediation Code Example (Node.js / pg-promise):
// INSECURE:
// const query = `SELECT * FROM users WHERE user = '${req.body.username}'`;

// SECURE (Parameterized):
const query = 'SELECT id, password_hash, role FROM users WHERE username = $1';
const user = await db.oneOrNone(query, [req.body.username]);
================================================================================