A manufacturer named Company M develops an Internet$-$based order management system.

Company M sells its products to wholesalers. Since wholesalers also use the order

management system, any security defects may result in damage to not only Company M but

also the wholesalers. Therefore, Company M requested Company S$,$ which provides security

analytic services, to perform a vulnerability analysis of the order management system.

$[$Order management system$]$

The order management system$$s application $($hereinafter$,$ the application$)$ runs on a Web

server. Orders, shipments, and other information are stored in an order information database

that runs on the database server. The application is used to reference and update the

information. Files that can be downloaded to or files that were uploaded from wholesaler$$s

PCs are stored on a disk that is connected to the Web server. Figure $1$ shows the configuration

of the order management system