starship / search / abf-ltl-freight-quotes

Audit report

ABF LTL Freight Quotes

WatchReach : limited

by Eniture Technology · Orders and shipping · Shopify App Store

Orders and shipping

Risk level

Watch

Executive summary

Get accurate LTL freight quotes at checkout

Key insights

◆Publisher Eniture Technology produces multi-platform shipping/freight plugins (Shopify, WordPress, Magento)
◆A confirmed unauthenticated SQL injection CVE (CVE-2024-13485) exists in the same-named WordPress edition of this product
◆Shopify app listing has 0 reviews and is not 'Built for Shopify' certified
◆Publisher website has HSTS but no CSP

Top findingsview all

High
Publisher has prior unauthenticated SQL injection CVE in sibling product

Synthesis

Analysis summary

Get accurate LTL freight quotes at checkout

Key insights

◆Publisher Eniture Technology produces multi-platform shipping/freight plugins (Shopify, WordPress, Magento)
◆A confirmed unauthenticated SQL injection CVE (CVE-2024-13485) exists in the same-named WordPress edition of this product
◆Shopify app listing has 0 reviews and is not 'Built for Shopify' certified
◆Publisher website has HSTS but no CSP
◆Privacy policy is sparse on data residency, sub-processors, and retention
◆App functionality is narrow: fetching ABF freight rate quotes at checkout, read-only shipping data use case

Detections

Findings (5)

Risks detected through static, network, and policy analysis.

Publisher has prior unauthenticated SQL injection CVE in sibling product

High

CVE-2024-13485: Eniture Technology's WordPress plugin 'LTL Freight Quotes – ABF Freight Edition' <= 3.3.7 had an unauthenticated SQL injection via 'edit_id' and 'dropship_edit_id' parameters. While this affects the WordPress edition (not the Shopify app directly), it is the same product line by the same publisher and indicates weak input sanitization practices in their backend code that likely powers both editions.

Evidence

https://wpscan.com/vulnerability/9bf52cec-b5ef-4687-a2ee-09643806f893/

Additional Broken Access Control CVE in sibling WordPress plugin

Medium

Patchstack lists a Broken Access Control vulnerability in the publisher's WordPress 'LTL Freight Quotes – Worldwide Express Edition' plugin, indicating recurring access-control issues across Eniture's product family.

Evidence

https://patchstack.com/database/wordpress/plugin/ltl-freight-quotes-worldwide-express-edition/vulnerability/wordpress-ltl-freight-quotes-worldwide-express-edition-plugin-5-2-1-broken-access-control-vulnerability

Publisher website missing Content-Security-Policy header

Low

https://eniture.com/ HTTP response does not include a Content-Security-Policy header. HSTS is configured (max-age=31536000; includeSubDomains) and other headers (X-Frame-Options, X-Content-Type-Options) are present, but CSP is absent.

Evidence

https://eniture.com/

Privacy policy lacks explicit data residency, sub-processor list, and retention period

Low

Eniture's privacy policy does not clearly disclose hosting region, third-party sub-processors, data retention periods, or compliance certifications (GDPR/SOC2/ISO27001).

Evidence

https://eniture.com/eniture-llc-privacy-policy/

App has zero reviews on Shopify App Store

Info

The Shopify listing shows 0.0 rating with 0 reviews and no 'Built for Shopify' badge, providing no community signal on operational stability.

Evidence

https://apps.shopify.com/abf-ltl-freight-quotes

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_products`	Medium	Likely needed to read product weight/dimensions for freight rating; not explicitly declared in listing but inferred from shipping-rate app pattern
`read_shipping`	Medium	Required to register Carrier Service for real-time rate quotes at checkout (inferred; not explicitly listed)

read_products

Medium

Likely needed to read product weight/dimensions for freight rating; not explicitly declared in listing but inferred from shipping-rate app pattern

read_shipping

Medium

Required to register Carrier Service for real-time rate quotes at checkout (inferred; not explicitly listed)

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: eniture.com
TLS grade: A
HSTS: Enabled
CSP: Missing

HSTS enabled (max-age=31536000; includeSubDomains). X-Frame-Options SAMEORIGIN, X-Content-Type-Options nosniff, Permissions-Policy restrictive. No Content-Security-Policy header. Apache/2.4.62 on Amazon Linux (AWS-hosted).

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Privacy policy exists but lacks explicit compliance certification claims, sub-processor list, retention periods, and data residency disclosures.

Track record

Publisher reputation

Publisher: Eniture Technology
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

●CVE

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

ABF LTL Freight Quotes

Key insights

Top findingsview all

Analysis summary

Findings (5)

Publisher has prior unauthenticated SQL injection CVE in sibling product

Additional Broken Access Control CVE in sibling WordPress plugin

Publisher website missing Content-Security-Policy header

Privacy policy lacks explicit data residency, sub-processor list, and retention period

App has zero reviews on Shopify App Store

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage