Exposing the Paypal bugFor those who are concerned about any ongoing privacy leaks There's no need to worry, because the vulnerability has been patched. On the other hand, the Polish security firm was able to release further information in regards to the eBay subsidiary's reported vulnerability (which was exposed back in January 2013). VL offered a proof-of-concept demonstration to showcase concerns when it told PayPal regarding the security hole. The payment processor then proceeded to have the bug patched before the end of January. Evidence is currently lacking in regards to hackers ever taking advantage of the flaw, although implications and the potential impact of such an exploit is considered grave indeed. At any rate, the security flaw was contained in the "bound compromised page id parameter listing" of the "analysis all review module", according to VL. What's more, an integer value that's not parsed or encoded in the URL path will be included by the server every time a customer attempts to process a link request to a given page. Hackers could replace this flaw in coding and integer page with their customized SQL manipulations to ruin and destroy the app's DBMS and all PayPal accounts associated with it, thus enabling them to get a payload of sensitive data in the meantime. That's not all.
PayPal services are furthermore compromised after a DBMS and SQL hacking thanks to the fact that the server is intertwined to the main site auth, thus enabling hackers to hit two vulnerable services with one SQL-coded stone.
Crackers are essentially offered a means to access all column and table databases that will enable them to pilfer GP personal data content and learn about information not meant for their eyes.
They also have the option to deface the website, use the compromise for special phishing expeditions or steal database username/password info at will, all from the critical bug that PayPal neglected to spot by itself.
|