9 replies to this topic

[AnthonyAU]

Hello everyone

if customers in ‘Order Confirmation user interface’ copy and paste or hand typing to modify the URL from “mystore.com/checkout_confirmation.php” to “mystore.com/checkout_process.php” this can be successfully place order without payment.

This is our store admin user interface “Sessions” current setting

Host server: Linux
------------------------------------------------------------------------------------------------------------
Session Directory     /home/mystore/public_html/includes/work/

Force Cookie Use     False   (Try in ‘Trun’ status still have issue)

Check SSL Session ID        False

Check User Agent      False

Check IP Address     False

Prevent Spider Sessions   True

Recreate Session True
------------------------------------------------------------------------------------------------------------
I using FireFox 13.0.1 to test this issue

Is this a session issue? Any setting I miss it?

Anyone know what happen and how to fix it?

[14steve14]

What version of oscommerce are you using.

[AnthonyAU]

Hi Steve

i check in 'Admin user interface' is showing

--------------------------------------------------------------------------------------

Version Checker

Installed Version: osCommerce Online Merchant v2.3.1

You are running the latest version of osCommerce Online Merchant.

----------------------------------------------------------------------------------------

[DunWeb]

@AnthonyAU


I believe the checkout order is:

shopping_cart.php
checkout_shipping.php
checkout_payment.php
  - this leads to the online payment processor and then returns the customer to the checkout_process.php (hidden file)
checkout_confirmation.php


checkout_process.php IS NEVER called up.  It is a file used to track the process only.


I tested this on my v2.3.1 store and could not alter the checkout process.  I received this error when trying to replicate your issue:

https://www.xxxxxx.com/shopping_cart.php?error_message=Express%20Checkout%20token%20is%20missing.

"Checkout Token is Missing"


Any further information you can share ?


Chris

[multimixer]

@AnthonyAU

what payment module did you use to do this?

[AnthonyAU]

Hi Chris and George


---------------------------------------------------------------------------------------------
For the Payment module:

Our store only to use - 'PayPal Website Payments Standard' (Version 1.0)

--------------------------------------------------------------------------------------------
Add-On:

- QTpro4.6.1

- Easy Meta Tags 1.8

-------------------------------------------------------------------------------------------

Attached - Order_without_payment.JPG
 Order_without_payment.JPG   96.72K   25 downloads

[AnthonyAU]

Hi everyone

Any new suggestion for this issue?

Am i setting worng? or i shounldn't setting like that?

[frankjohnson8]

What version of oscommerce are you using.

Edited by frankjohnson8, 13 July 2012 - 09:34 AM.

[AnthonyAU]

Hi Frank

i Installed Version 2.3.1

[DunWeb]

@AnthonyAU

Refer to the Closing PayPal Exploit thread



Chris