Summary
Acunetix 360 detected that a critical form's action is targetted an HTTP resource.
Impact
If an attacker can intercept network traffic, he/she can steal users' credentials. In this case even though the form is served over HTTPS, it'll be submitted to an HTTP resource. This defeats the purpose of SSL protection for this form.
Actions To Take
- See the remedy for solution.
- Move all of your critical forms to HTTPS and ensure their form actions are targetting HTTPS.
Remediation
All sensitive data should be transferred over HTTPS rather than HTTP. Forms should be served over and form actions also should target HTTPS. All aspects of the application that accept user input, starting from the login process, should only be served over HTTPS.