eWallet Online Payment Gateway 2 - Cross-Site Request Forgery

eWallet Online Payment Gateway 2 - Cross-Site Request Forgery Exploit Title: eWallet - Online Payment Gateway 2 - Cross-Site Request Forgery Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/ewallet-online-payment-gateway/19316332?srank=1110 Version: 2 Tested on:...

eWallet Online Payment Gateway 2 - Cross-Site Request Forgery

Exploit Title: eWallet - Online Payment Gateway 2 - Cross-Site Request Forgery Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/ewallet-online-payment-gateway/19316332?srank=1110 Version: 2 Tested on: Kali linux POC : eWallet - Online Payment Gateway 2 suffers fr...

paymentgatewayonline.info XSS vulnerability

Vulnerable URL: http://paymentgatewayonline.info/sploit/view.php?where=%27%22%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

barrecertification.com XSS vulnerability

Open Bug Bounty ID: OBB-279869 Description| Value ---|--- Affected Website:| barrecertification.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-7992

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI (cavv parameter). Root cause: unsanitized input echoed in the response, enabling injection of arbitrary scripts. Impact per provi...

fttsecurepaymentgateway.com XSS vulnerability

Vulnerable URL: https://www.fttsecurepaymentgateway.com/TradingWeb/joinWelcomeInit.action?urlSource=CTT'"--!confirmOPENBUGBOUNTY...

iTechScripts Payment Gateway Script 8.46 SQL Injection

Exploit Title : Payment Gateway Script v8.46 - Multiple Vulnerability Author : Hasan Emre Ozer Google Dork : - Date : 18/01/2017 Type : webapps Platform: PHP Vendor Homepage : http://itechscripts.com/payment-gateway-script/ Sofware Price and Demo : $400 http://payment-gateway.itechscripts.com...

‘One-Stop Shop’ – Phishing Domain Targets Information from Customers of Several Indian Banks

FireEye Labs recently discovered a malicious phishing domain designed to steal a variety of information – including credentials and mobile numbers – from customers of several banks in India. Currently, we have not observed this domain being used in any campaigns. The phishing websites appear to b...

WP eCommerce <= 3.11.3 - SQL Injection in sessionid

From vendor: "This vulnerability only affects users who use eWay as their payment gateway, have Gold Cart activated, and are using the as-of-yet-unreleased Theme Engine 2.0. We believe the number of users affected is likely close to zero, due to these conditions – but still, we highly recommend...

324,000 Financial Records with CVV Numbers Stolen From A Payment Gateway

Around 324,000 users have likely had their payment records stolen either from payment processor BlueSnap or its customer Regpack; however, neither of the company has admitted a data breach. BlueSnap is a payment provider which allows websites to take payments from customers by offering merchant...

iBilling 3.7.0 Cross Site Scripting

Cross Site Scripting Stored: http://localhost/ibilling/index.php Parameters: msg, desc, account, phone, company, address, city, state, zip, tags, description, ref POST...

iBilling 3.7.0 - Persistent Cross-Site Scripting / Reflected Cross-Site Scripting

Exploit for php platform in category web applications iBilling v3.7.0 Multiple Stored and Reflected Cross Site Scripting Vulnerabilities Vendor: iBilling Product web page: http://www.ibilling.io/ Affected version: 3.7.0 Summary: The features you want, the simplicity you need! Beautifully designed...

Commerce Authorize.Net SIM/DPM Payment Methods - Access Bypass - DRUPAL-SA-CONTRIB-2016-006

This module enables you to make credit card payments for Drupal Commerce orders via the Authorize.Net payment gateway using either their SIM hosted payment page or DPM direct post method mechanisms. The module doesn't sufficiently protect against the premature triggering of order completion witho...

Commerce Commonwealth (CBA) - Moderately Critical - Insufficient Verification of API Data - SA-CONTRIB-2015-136

This module enables you to pay for items on Drupal Commerce, using Commerce Commonwealth payment gateway. The module doesn't sufficiently validate the payment under certain specific scenarios. A malicious user can modify the urls used in gateway interaction with Commbank to make a failed payment...

ok.ru: Покупка песни дешевле, чем она стоит.

Итак, часть песен в приложении можно купить. Нажимая на кнопку купить, происходит запрос к серверу обрезано, для удобства: GET /isDownloaded;jsessionid=DZSUq1yTUMNFNcYk5-mZ10DGJbUCoNYFHRUcNNwINHoSrDkkkf4gInosiPimoqGaysNvWs7GV7fnOMGgfsbCA.hHaqWq9PyS8b9PmEoYfcA?tid=90920917758231 В ответ получаем:...

WordPress SagePay Direct Payment Gateway Plugin <= 0.1.6.6 - Reflected XSS

This plugin is prone to a reflected cross site scripting vulnerability in pages/3DRedirect.php, pages/3DCallBack.php and pages/3DComplete.php multiple parameter. Solution Update the plugin...

Shopify: Payment gateway status transferred to Shopify without authentication

Note: This issue was originally reported to our self-hosted bug bounty program, and was transferred to HackerOne. One of the third-party payment gateways that can be used with Shopify did not offer a secure means of reporting transaction status to Shopify. As a result, it was possible for an...

CHARGE Anywhere Breached, Plain Text Data Accessed

CHARGE Anywhere, a New Jersey-based developer of payment gateway and mobile payment applications, on Tuesday disclosed that it had been breached and that hackers had access to transactions leaving its network, perhaps going back as far as 2009. Most of the traffic was encrypted, the company said ...

WooCommerce SagePay Direct Payment Gateway 0.1.6.6 - pages/3DComplete.php Multiple Parameter Reflected XSS

The sagepay-direct-for-woocommerce-payment-gateway WordPress plugin was affected by a pages/3DComplete.php Multiple Parameter Reflected XSS security vulnerability...

CVE-2014-4549

Multiple cross-site scripting XSS vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 MD or 2 PARes parameter...