Urgent: Able to skip paypal payment and place order

Prev Go to previous topic

Go to next topic

Last Post 9/6/2021 1:15 AM by Bryan

1 Replies

0 Subscribed to this topic

1 Subscribed to this forum

Sort:


You are not authorized to post a reply.

Author

Messages

Basic Member

Posts:39

9/1/2021 11:40 PM
Hi, Was doing some testing to see if I could replicate an order issue and came across an exploit. 1. Place an order via PayPal & complete it with success URL. 2. Copy the success URL at receipt screen ie domain.com /shop/checkout/ctl/ThirdPartyPayment/mid/1778?token=EC-1W3254626J198490T&PayerID=G64GE4KVV3SHG 3. add products to cart and place another order via paypal. 4. At paypal payment screen, paste the previous successful URL 5. Order is placed. Skipping payment. 6. check back office to see a new order has been placed. order emails sent. Can confirm its with 3.5.0 only, seems the older version displays a different URL when receiving success / receipt after payment domain.com /Shop/Checkout/action/receipt/id/a1e3a629-c7fa-4596-8ada-0d35f49dfca8 I have default view sets templates applied. Please look into this as soon as possible as I'm yet to know how to solve it.

Basic Member

Posts:53

9/6/2021 1:15 AM
Hi All I've also run some test on this. DNN - 09.09.01 (0) HCC - 3.5.0 steps to recreate [list=1][]complete an order of any value with paypal []copy the return url []begin another order of any value but when you get redirected to the paypal website do not complete payment, instead paste your copied return url either over the paypal website or a new tab in same browser. []sale completes and there is no way to see that the person has not paid. []the only clue inside hotcakes is under the 'payment' tab for the transaction all the ref numbers are the same across transactions. []this can be completed multiple times with the same success url[/list] This is obviously a major flaw and clearly there is a verification step on receiving the return url that should check that it is for the matching transaction seem to be no present or simply not working.

You are not authorized to post a reply.