I am surprised on this. Why CCAvenue did not conduct a vulnerability test on their applications? It is standard practice to conduct a VA on production systems,

I am surprised on this. Why CCAvenue did not conduct a vulnerability test on their applications? It is standard practice to conduct a VA on production systems, which will certainly identify this kind of vulnerabilities. A Payment facilitator going down because of an SQL injection attack is ridiculous. Indian market is paranoid about online security. This will bring down the number of online sales. Too bad for start-ups depending on CCAvenue.