Home page logo

bugtraq logo Bugtraq mailing list archives

Remote Exploit in Business::OnlinePayment::WorldPay::Junior
From: Jason Clifford <security () jason ukpost com>
Date: Sat, 15 Mar 2003 10:16:05 +0000 (GMT)

Business::OnlinePayment::WorldPay::Junior is a perl module providing a 
backend for perl scripts to manage credit/debit card payments through the 
WorldPay Select Junior service.

I am the author of the module.

There is a bug in all version of Business::OnlinePayment::WorldPay::Junior 
prior to 1.05 (released yesterday) in that the module fails to properly 
check that the test mode of a transaction returned from WorldPay via their 
callback facility is the same as that recorded for the transaction before 
the user was sent to WorldPay to effect the payment.

This exposes any script using the module to a HTML page rewriting exploit 
by the site visitor.

Version 1.05 of the module fixes this problem. 

Note that the module as also been renamed with this version to 
Business::WorldPay::Junior to avoid namespace conflicts with the 
Business::OnlinePayment API.

Anyone updating to the new version should apply the following regex to any 
scripts using the module:


Jason Clifford
UKFSN.ORG               Finance Free Software while you surf the 'net
http://www.ukfsn.org/           Get the T-Shirt Now

  By Date           By Thread  

Current thread:
  • Remote Exploit in Business::OnlinePayment::WorldPay::Junior Jason Clifford (Mar 15)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]