Was doing some testing to see if I could replicate an order issue and came across an exploit.

1. Place an order via PayPal & complete it with success URL.
2. Copy the success URL at receipt screen ie /shop/checkout/ctl/ThirdPartyPayment/mid/1778?token=EC-1W3254626J198490T&PayerID=G64GE4KVV3SHG
3. add products to cart and place another order via paypal.
4. At paypal payment screen, paste the previous successful URL
5. Order is placed. Skipping payment.
6. check back office to see a new order has been placed. order emails sent.

Can confirm its with 3.5.0 only, seems the older version displays a different URL when receiving success / receipt after payment /Shop/Checkout/action/receipt/id/a1e3a629-c7fa-4596-8ada-0d35f49dfca8

I have default view sets templates applied.

Please look into this as soon as possible as I'm yet to know how to solve it.
Hi All

I've also run some test on this.
DNN - 09.09.01 (0)
HCC - 3.5.0

steps to recreate
  1. complete an order of any value with paypal
  2. copy the return url
  3. begin another order of any value but when you get redirected to the paypal website do not complete payment, instead paste your copied return url either over the paypal website or a new tab in same browser.
  4. sale completes and there is no way to see that the person has not paid.
  5. the only clue inside hotcakes is under the 'payment' tab for the transaction all the ref numbers are the same across transactions.
  6. this can be completed multiple times with the same success url

This is obviously a major flaw and clearly there is a verification step on receiving the return url that should check that it is for the matching transaction seem to be no present or simply not working.

  • Sign-up for the Hotcakes Community Newsletter: