A Reflected XSS vulnerability in this sdk

[jgj212]

Hello:
I found a Reflected XSS vulnerability in this sdk.

The vulnerability exists due to insufficient filtration of user-supplied data in 'fort_id' HTTP _REQUEST parameter that will be passed to “payfort-php-sdk-master/success.php”. The infected source code is line 16, there is no protection on $_REQUEST['fort_id']; If $_REQUEST['fort_id'] contains evil js code, line 16 will trigger untrusted code to be excuted on the browser side

So if a attacker construct a special url as follow and send it to a victim, when the victim click the url, the code which is contained in the url will be executed on the victim's browser side to do some evil.
http://your-web-root/payfort-php-sdk-master/success.php?fort_id="><script>alert(1);</script><"

The follow screenshot is the result to click the upper url ( win7 sp1 x64 + firefox 51.0.1 32bit ):

Discoverer: ADLab of Venustech

[mohannadsaleh]

Hello

Thank you for your feedback , the page you are targeting is a simulator page created to help developers to list parameters returned during the integration

Best Regards,

[mohannadsaleh]

we have removed $_REQUEST['fort_id'] from our sample and replaced it with parameter name "fort_id"