search

hps / heartland-php

Heartland Payment Systems Payment Gateway PHP SDK
https://developer.heartlandpaymentsystems.com/SecureSubmit/
GNU General Public License v2.0
25 stars 23 forks source link

A Reflected XSS vulnerability in this sdk #28

Closed jgj212 closed 7 years ago

jgj212 commented 7 years ago

Hello: I found a Reflected XSS vulnerability in this sdk.

The vulnerability exists due to directly output user-supplied data in HTTP GET parameter, this happended in the file "heartland-php-master\examples\consumer-authentication\cruise.php". The infected source code is line 27, there is no protection on $_GET; code1

if $_GET contains evil js code, line 27 will trigger untrusted code to be excuted on the browser side.

So if a attacker construct a special url as follow and send it to a victim, when the victim click the url, the code which is contained in the url will be executed on the victim's browser side to do some evil. http://your-web-root/heartland-php-master/examples/consumer-authentication/cruise.php?cavv="><"

The follow scrrenshot is the result to click the upper url ( win7 sp1 x64 + firefox 51.0.1 32bit ): sc

Discoverer: ADLab of Venustech

jgj212 commented 7 years ago

this issue is fixed from v2.9.1 by adding a line as follow

"$_GET = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING);"