PT-2006-1278 · Paypal · Paypal Web Services

Cens · Publicado 2006-01-13 · Atualizado 2011-03-08 · CVE-2006-0201

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PayPal Web Services (aka PHP Toolkit) versions 0.50 and earlier

Description The issue allows remote attackers to enter false payment entries into the log file. This can be achieved via HTTP POST requests to the "ipn success.php" endpoint.

Recommendations For versions 0.50 and earlier, consider restricting access to the "ipn success.php" endpoint until a fix is available. Additionally, monitor log files for suspicious payment entries to minimize potential damage.

Correção

Identificadores relacionados

CVE-2006-0201

Produtos afetados

Paypal Web Services

Referências · 7

• http://uinc.ru/articles/vuln/ptpaypal050.shtml · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-0201 · Nota de Segurança
• http://osvdb.org/22378 · Nota
• http://securityfocus.com/archive/1/421739 · Aviso do Fabricante
• http://securityfocus.com/bid/16218 · Nota
• http://vupen.com/english/advisories/2006/0183 · Nota
• http://secunia.com/advisories/18444 · Aviso do Fabricante