Exposing the Paypal bug
It was earlier reported by SecPoint that PayPal suffered a security and privacy breach thanks to an SQL injection vulnerability that wasn't fixed in time. A $3,000 reward was given to the VL (Vulnerability Laboratory) team of researchers after they found out and told people of the critical flaw found in the web app service of PayPal known as the PayPal GP . It's an exploitable security hole that could be manipulated from a remote distance that enabled attackers to inject orders through the compromised web-based software into backend databases, which could then lead to trick the apps into exposing data that was meant for the eyes of the owners of such private info alone.
For those who are concerned about any ongoing privacy leaks
There's no need to worry, because the vulnerability has been patched.
On the other hand, the Polish security firm was able to release further information in regards to the eBay subsidiary's reported vulnerability (which was exposed back in January 2013).
VL offered a proof-of-concept demonstration to showcase concerns when it told PayPal regarding the security hole.
The payment processor then proceeded to have the bug patched before the end of January.
Evidence is currently lacking in regards to hackers ever taking advantage of the flaw, although implications and the potential impact of such an exploit is considered grave indeed.
At any rate, the security flaw was contained in the "bound compromised page id parameter listing" of the "analysis all review module", according to VL.
What's more, an integer value that's not parsed or encoded in the URL path will be included by the server every time a customer attempts to process a link request to a given page.
Hackers could replace this flaw in coding and integer page with their customized SQL manipulations to ruin and destroy the app's DBMS and all PayPal accounts associated with it, thus enabling them to get a payload of sensitive data in the meantime.
That's not all.
PayPal services are furthermore compromised after a DBMS and SQL hacking thanks to the fact that the server is intertwined to the main site auth, thus enabling hackers to hit two vulnerable services with one SQL-coded stone.
Crackers are essentially offered a means to access all column and table databases that will enable them to pilfer GP personal data content and learn about information not meant for their eyes.
They also have the option to deface the website, use the compromise for special phishing expeditions or steal database username/password info at will, all from the critical bug that PayPal neglected to spot by itself.