PT-2006-1278 · Paypal · Paypal Web Services

Cens · Published 2006-01-13 · Updated 2011-03-08 · CVE-2006-0201

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PayPal Web Services (aka PHP Toolkit) versions 0.50 and earlier

Description The issue allows remote attackers to enter false payment entries into the log file. This can be achieved via HTTP POST requests to the "ipn success.php" endpoint.

Recommendations For versions 0.50 and earlier, consider restricting access to the "ipn success.php" endpoint until a fix is available. Additionally, monitor log files for suspicious payment entries to minimize potential damage.

Fix

Related Identifiers

CVE-2006-0201

Affected Products

Paypal Web Services

References · 7

• http://uinc.ru/articles/vuln/ptpaypal050.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0201 · Security Note
• http://securityfocus.com/archive/1/421739 · Vendor Advisory
• http://secunia.com/advisories/18444 · Vendor Advisory
• http://osvdb.org/22378 · Note
• http://securityfocus.com/bid/16218 · Note
• http://vupen.com/english/advisories/2006/0183 · Note