PayPal as you all knows one of the leading companies in today’s online transaction. Recently Nir Goldshlager, founder of Breaksec and Security Researcher reported critical flaws in Paypal Reporting system that allowed him to steal private data of any PayPal account. Exploiting the vulnerabilities he discovered, allowed him to access the financial information of any PayPal user including victim's shipping address, Email addresses, Phone Number, Item name, Item Amount, Full name, Transaction/Invoice ID, Transaction, Subject, Account ID, Paypal Reference ID and many more.
He found that PayPal is actually using the Actuate Iportal Application (a third party app) to display customer reports, so Nir downloaded the trial version of this app for testing purpose from its official website.
After going deeply through the source code of trial version, Nir located a file named getfolderitems.do that allowed him to access user's data without credentials. For more information see the pictures below-
Update- PayPal Security Team has fixed this bug now! Thanks…
Also read- How Hackers can Make Money with PayPal Bug Bounty Programs?
No comments:
Post a Comment
Your feedback is always Precious to us.
I will try to answer all the queries as soon as possible.
Regards
karan chauhan