Skip to content
This repository has been archived by the owner on Jul 20, 2020. It is now read-only.

I have find a Reflected XSS vulnerability in this sdk #87

Closed
jgj212 opened this issue Feb 21, 2017 · 1 comment
Closed

I have find a Reflected XSS vulnerability in this sdk #87

jgj212 opened this issue Feb 21, 2017 · 1 comment

Comments

@jgj212
Copy link

jgj212 commented Feb 21, 2017

Hello:
I have find a Reflected XSS vulnerability in this sdk.

The vulnerability exists due to insufficient filtration of user-supplied data in “payKey” HTTP REQUEST parameter that will be passed to “adaptivepayments-sdk-php-master\samples\SetPaymentOptions.php”. The infected source code is line 24, there is no protection on $_REQUEST['payKey']; if $_REQUEST['payKey'] contains evil js code, line 24 will trigger untrusted code to be executed on the browser side.
image

So if a attacker construct a special url as follow and send it to a victim, when the victim click the url, the code which is contained in the url will be executed on the victim's browser side to do some evil.
http://your-web-root/adaptivepayments-sdk-php-master/samples/SetPaymentOptions.php?payKey="><script>alert(1);</script><"

The follow scrrenshot is the result to click the upper url ( win7 sp1 x64 + firefox 51.0.1 32bit ):
image

Discoverer:ADLab of Venustech

@randstraw
Copy link

Adding internal tracking: BTDXCLTS-283

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants