{"id":2136,"date":"2019-06-24T15:16:59","date_gmt":"2019-06-24T19:16:59","guid":{"rendered":"https:\/\/www.thatsoftwareguy.com\/blog\/?p=2136"},"modified":"2019-06-27T08:23:00","modified_gmt":"2019-06-27T12:23:00","slug":"payment-page-credential-stealing-in-zen-cart","status":"publish","type":"post","link":"https:\/\/www.thatsoftwareguy.com\/blog\/2019\/06\/24\/payment-page-credential-stealing-in-zen-cart\/","title":{"rendered":"Payment Page Credential Stealing in Zen  Cart"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">I have seen several successful attacks in the last month on Zen Cart which have used the Minimum Values fields.  (osCommerce has a similar vulnerability.)  The attack works as follows: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Inject a script into one of the CC min length fields (in this case, CC_NUMBER_MIN_LENGTH).  <\/li><li>This script will fire when the payment page is loaded if onsite card number capture is being used. <\/li><li>The script does an AJAX POST to a remote server. <\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Here&#8217;s a screenshot of the Admin-&gt;Configuration-&gt;Minimum Values field: <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" src=\"https:\/\/www.thatsoftwareguy.com\/blog\/wp-content\/uploads\/2019\/06\/hack-1024x429.png\" alt=\"Zen Cart credit card minimum values hack\" class=\"wp-image-2137\" srcset=\"https:\/\/www.thatsoftwareguy.com\/blog\/wp-content\/uploads\/2019\/06\/hack-1024x429.png 1024w, https:\/\/www.thatsoftwareguy.com\/blog\/wp-content\/uploads\/2019\/06\/hack-300x126.png 300w, https:\/\/www.thatsoftwareguy.com\/blog\/wp-content\/uploads\/2019\/06\/hack-768x321.png 768w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">A proposed defense against this attack is to cast integer values from the configuration table as integers, thereby ensuring the script does not get echo&#8217;ed on the page.  You can see my implementation in <a rel=\"noreferrer noopener\" aria-label=\"Zen Cart 1.5.7 Pull Request #2471 (opens in a new tab)\" href=\"https:\/\/github.com\/zencart\/zencart\/pull\/2471\" target=\"_blank\">Zen Cart 1.5.7 Pull Request #2471<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">*** Update: This PR was accepted into the Zen Cart core on 06\/25\/2019. It will be part of Zen Cart 1.5.7 (and may be backported to Zen Cart 1.5.6c, if there is an additional patch to that stream). <\/p>\n","protected":false},"excerpt":{"rendered":"<p>I have seen several successful attacks in the last month on Zen Cart which have used the Minimum Values fields. (osCommerce has a similar vulnerability.) The attack works as follows: Inject a script into one of the CC min length fields (in this case, CC_NUMBER_MIN_LENGTH). This script will fire when the payment page is loaded &hellip; <a href=\"https:\/\/www.thatsoftwareguy.com\/blog\/2019\/06\/24\/payment-page-credential-stealing-in-zen-cart\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Payment Page Credential Stealing in Zen  Cart<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58,78],"tags":[],"class_list":["post-2136","post","type-post","status-publish","format-standard","hentry","category-that-software-guy","category-zen-cart"],"_links":{"self":[{"href":"https:\/\/www.thatsoftwareguy.com\/blog\/wp-json\/wp\/v2\/posts\/2136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thatsoftwareguy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thatsoftwareguy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thatsoftwareguy.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thatsoftwareguy.com\/blog\/wp-json\/wp\/v2\/comments?post=2136"}],"version-history":[{"count":2,"href":"https:\/\/www.thatsoftwareguy.com\/blog\/wp-json\/wp\/v2\/posts\/2136\/revisions"}],"predecessor-version":[{"id":2139,"href":"https:\/\/www.thatsoftwareguy.com\/blog\/wp-json\/wp\/v2\/posts\/2136\/revisions\/2139"}],"wp:attachment":[{"href":"https:\/\/www.thatsoftwareguy.com\/blog\/wp-json\/wp\/v2\/media?parent=2136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thatsoftwareguy.com\/blog\/wp-json\/wp\/v2\/categories?post=2136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thatsoftwareguy.com\/blog\/wp-json\/wp\/v2\/tags?post=2136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}