Post-Pandemic world, Shut-downs, and Web Security Connections

As the anniversary of the World Health Organization’s WHO declaration of the COVID-19 pandemic approaches, we, here in Silicon Valley, have great hope for 2021. As the vaccine distribution continues to trickle to Main Street, Californians have recently exited a stay-at-home mandate that has nearl...

‘ValidCC,’ a Major Payment Card Bazaar and Looter of E-Commerce Sites, Shuttered

ValidCC, a dark web bazaar run by a cybercrime group that for more than six years hacked online merchants and sold stolen payment card data, abruptly closed up shop last week. The proprietors of the popular store said their servers were seized as part of a coordinated law enforcement operation...

Magento Web Skimmers Piggyback in Ongoing Costway Website Compromise

Two web skimmers have been discovered on the payment webpages of Costway, one of the top retailers in North America and Europe, which sells appliances, furniture and more. The skimmers are targeting consumers’ credit-card payment details. In a twist, researchers say one of these web skimmers is...

Credit card skimmer piggybacks on Magento 1 hacking spree

Back in the fall of 2020 threat actors started to massively exploit a vulnerability in the no-longer maintained Magento 1 software branch. As a result, thousands of e-commerce shops were compromised and many of them injected with credit card skimming code. While monitoring activities tied to this...

CMSWing SQL Injection Vulnerability (CNVD-2021-09500)

CMSWing is a ThinkJS-based e-commerce platform and CMS builder. CMSWing 1.3.8 suffers from a SQL injection vulnerability. The vulnerability stems from the updateAction function not checking the detail parameter. An attacker can exploit this vulnerability to execute arbitrary SQL commands via...

CMSWing SQL Injection Vulnerability

CMSWing is a ThinkJS-based e-commerce platform and CMS builder. A SQL injection vulnerability exists in CMSWing 1.3.8. The vulnerability stems from the rechargeAction function not checking the balance parameter. An attacker can exploit this vulnerability to execute arbitrary SQL commands via...

How Grinch Buying Bots Took the Gaming Hardware Market Hostage

In video games jargon, the phrase “Console Wars" refers to the fierce competition between hardware manufacturers for market share. It turns out, however, that the only war going on at the moment is for acquiring a console. And thus far, Grinch Bots are winning. Video Games’ Popularity Is Peaking...

newbee-mall Access Control Error Vulnerability

newbee-mall is an e-commerce system. An access control error vulnerability exists in all versions of newbee-mall, where an attacker cannot remotely gain privileges via NewBeeMallIndexConfigServiceImpl. java, but can make unauthorized changes to any user information via userID...

Newbee-mall Cross-Site Scripting Vulnerability

newbee-mall is an e-commerce system. A cross-site scripting vulnerability exists in newbee-mall 1.0, where a user only needs to write an xss payload in the address information when purchasing a product, and the vulnerability is triggered when viewing the "View Recipient Information" of the order ...

Online fraud at an all-time high amidst the global pandemic

Client-side attacks have become significantly more prominent in recent years, gaining popularity since 2015. As online activity rises due to the global pandemic, 2020 has been no exception, with the most susceptible target, e-commerce, becoming more lucrative than ever. The Client-Side Problem...

Stacking CDNs for Improved Performance and Security

I recently worked with a client whose large e-commerce site was hosted with a popular cloud-based commerce solution. Its business was growing rapidly into new geographic markets, and it was not satisfied with the embedded content delivery network eCDN that was bundled with the cloud solution. We...

How Client-Side Protection & Compliance Detects Real-World Magecart Attacks

In this blog, we will take a look at and break down a recent Magecart attack detected and mitigated by Client-Side Protection & Compliance. The impacted customer operates a large international e-commerce business in which one of its websites was compromised with a malicious script...

PrestaShop SQL Injection Vulnerability (CNVD-2021-06534)

Prestashop is a set of open source e-commerce solutions from the United States Prestashop. The solution provides a variety of payment methods , short message alerts and product image scaling and other features . PrestaShop 1.7.7.0 suffers from a SQL injection vulnerability in which the source...

Oracle E-Business Suite Authorization Issues Vulnerability (CNVD-2021-08448)

Oracle E-Business Suite E-Business Suite is a fully integrated set of global business management software from Oracle USA. The software provides customer relationship management, service management, financial management and other functions. iStore is one of the business can effectively build,...

PT-2021-3845

Name of the Vulnerable Software and Affected Versions SourceCodester E-Commerce Website version 1.0 Description The issue allows remote attackers to execute arbitrary SQL statements via the update parameter to "empViewUpdate.php". This is related to the lack of protection for the SQL query...

PT-2021-3847

Name of the Vulnerable Software and Affected Versions SourceCodester E-Commerce Website version 1.0 Description The issue is related to an arbitrary file upload vulnerability in the prodViewUpdate.php script of the E-Commerce Website system. This vulnerability allows an attacker to upload files o...

PT-2021-3846

Name of the Vulnerable Software and Affected Versions SourceCodester E-Commerce Website version 1.0 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the subject field to "feedback...

Chongqing Fengshengjia E-commerce Co., Ltd. mall CMS exists overstepping the right loophole

The business scope of Chongqing Feng Shengjia E-commerce Co., Ltd. includes: Internet sales, advertising design and agency, software development, enterprise management, etc.. Chongqing Feng Shengjia E-commerce Co., Ltd. mall CMS has an overstepping vulnerability, which can be exploited by attacke...

Taking a Neighborhood Watch Approach to Retail Cybersecurity

Every year retailers face a heightened level of risk during the online holiday shopping season. COVID-19 drastically shifted consumer buying behaviors, forcing retailers to accelerate digital transformation efforts to support an exponentially higher number of online transactions. Projected U.S...

File Upload Vulnerability in Laiku Push E-commerce System (CNVD-2021-01290)

Laike Push www.laiketui.com is a mall system and mall website construction provider for enterprise-level businesses to provide retail mall, B2B2C multi-user mall system, community group-buying mall system, micro letter distribution system, small program mall, micro distribution system and other...