Web application security audit of a newsletter functionality