HotcakesCommerce / hotcakes-commerce-core

The core of the e-commerce part of the overall solution. This is an ecommerce shopping cart solution built on top of the DNN (DotNetNuke) CMS. Anyone can do commerce online now!
https://mmmcommerce.com
MIT License
70 stars 55 forks source link

Security Fix : Credit Card Number Exposed openly in request response #315

Closed sniravj closed 4 years ago

sniravj commented 4 years ago

During the checkout process the application sends an apparently unneeded request containing the submitted credit card number. This request results in the application responding with a 200 OK and the submitted creditcard number. Later after continuing with the checkout process the application again sends the credit cardnumber for final submission. Code updates and Encrypt the CC # and decrypt on server side for further processing removing the issue regardless the payment provider used by system.