Cross-site scripting (XSS) vulnerability in Paypal-Merchant-SDK-PHP

Hello: I have find a Reflected XSS vulnerability in this sdk. The vulnerability exists due to insufficient filtration of user-supplied data in “token” HTTP GET parameter that will be passed to “merchant-sdk-php\samples\AccountAuthentication\GetAuthDetails.html.php”. The infected source code is line 7, there is no protection on _GET[‘token’]; if _GET[‘token’] contains evil js code, line 21 will trigger untrusted code to be excuted on the browser side. So if a attacker construct a special url as follow and send it to a victim, when the victim click the url, the code which is contained in the url will be executed on the victim’s browser side to do some evil. “http://localhost/php-pro/merchant-sdk-php-master/AccountAuthentication/GetAuthDetails.html.php?token=>” The follow scrrenshot is the result to click the upper url ( win7 spq x64 + firefox 51.0.1 32bit ): Discoverer: ADLab of Venustech The text was updated successfully, but these errors were encountered: All reactions