Hello:
I have find a Reflected XSS vulnerability in this sdk.
The vulnerability exists due to insufficient filtration of user-supplied data in “token” HTTP GET parameter that will be passed to “merchant-sdk-php\samples\AccountAuthentication\GetAuthDetails.html.php”. The infected source code is line 7, there is no protection on _GET[‘token’]; if _GET[‘token’] contains evil js code, line 21 will trigger untrusted code to be excuted on the browser side.
Hello:
I have find a Reflected XSS vulnerability in this sdk.
The vulnerability exists due to insufficient filtration of user-supplied data in “token” HTTP GET parameter that will be passed to “merchant-sdk-php\samples\AccountAuthentication\GetAuthDetails.html.php”. The infected source code is line 7, there is no protection on _GET[‘token’]; if _GET[‘token’] contains evil js code, line 21 will trigger untrusted code to be excuted on the browser side.
So if a attacker construct a special url as follow and send it to a victim, when the victim click the url, the code which is contained in the url will be executed on the victim's browser side to do some evil.
"http://localhost/php-pro/merchant-sdk-php-master/AccountAuthentication/GetAuthDetails.html.php?token=><script>alert(1);</script>"
The follow scrrenshot is the result to click the upper url ( win7 spq x64 + firefox 51.0.1 32bit ):

Discoverer: ADLab of Venustech
The text was updated successfully, but these errors were encountered: