Title:
**********************
Transfer any amount regardless of what customer confirmed
**********************
Short description:
**********************
In PayPal Express Checkout the Online-Shop can transfer
any amount, no matter which amount the client actually
confirmed at the PayPal website.
**********************
Steps to reproduce:
**********************
1. SetExpressCheckout with any amount (e.g. 1 Dollar)
2. After confirmation of that Dollar simply call
DoExpressCheckoutPayment with any amount (e.g. 200 Dollar)
**********************
Proof of Concept:
**********************
URL:
http://lvps91-250-100-5.
Just click 'step 1', login with your paypal-account and
confirm 1 (one) Euro. After that you'll be redirected
back to my Proof of Concept site to confirm the transfer
of 2 (two) Euros, but of course this step could be fully
automatic without your knowledge as my website could
display just anything else.
You have to press the Button 'step 2' to actually transfer
2 Euros, and the only verification you'll have of this
bug working is the confirmation-email from PayPal which
will show 2 Euros instead of 1 (if you choose to check
those emails at all..)
This Proof of Concept transfers only 1 Euro more than
the confirmed amount, but I also tried with
200 Euro and it works just the same.
**********************
Screenshots
**********************
http://lvps91-250-100-5.
http://lvps91-250-100-5.
http://lvps91-250-100-5.
http://lvps91-250-100-5.
http://lvps91-250-100-5.
**********************
PayPal Bug Bounty (submitted 6th of July 2014)
**********************
This BUG was submitted to PayPal as EIBBP-29086, but
PayPal denies this as a security vulnerability.
Anyway, me personally, I'm really having trouble
confirming payments with PayPal as i know that
i don't confirm the displayed amount, but simply any
amount the shop-software chooses to transfer (be it
because of a simple software-bug or bad behaviour).
PayPal says this is 'intended behaviour' due to small
changes in shipping costs and such.
They deny any Bounty.
**********************
Proposed Fixes
**********************
1. PayPal should require that any higher amount than the
confirmed one has to be reconfirmed on their website.
This would be the correct way to implement this.
2. PayPal could allow a small difference to what was
confirmed and should at the same time display this at
the confirmation page, maybe like this:
"You confirm 100 Euro (+-10 Euro for adopted shipping)"
3. Temporary Fix:
A Browser-Extension should change the PayPal confirmation
Website according to this screenshot:
http://lvps91-250-100-5.
best regards,
Jan Kechel
- --
publictimestamp.org/ptb/PTB-
06D21B6FC2FA0D77CDC2F4CB2AC551
Komentarų nėra:
Rašyti komentarą