Jump to content
  • Checkout
  • Login
  • Get in touch

osCommerce

The e-commerce.

osCommece Credit Card payment module loophole?


zhexiang

Recommended Posts

Someone by the name Ali Babba from US just shop at my store and bought lots of digital products.

 

His payment method is credit card, but when i check with admin, i can't find his credit crad number, nor his credit card expiry date.

 

Is it possible to skip the credit card number during checkout? This credit card payment module is default with osCommerce?

 

I don't think it's possible for me to claim back US$350+ from this fellow. None of his personal detail is real.

 

Please advise on osCommerce credit card payment module, why buyer can skip entering the credit card number, any possiblity to avoid using it!

Link to comment
Share on other sites

I am by no means an expert in this area, but it is possible that some of the code you are using is unsecure and relies on having register_globals set to on. register_globals allows uninitialized variables to be used, thus allowing unsecure coding. When this happens, someone who is familiar with the program you are using may be able to use a variable (such as "Did you enter a credit card number?") without that variable being validly set by your program. Read this for a better description: http://us3.php.net/manual/en/security.registerglobals.php

 

I am not saying that this is what happened to you, but I recently learned about register_globals and this is the type of thing that can happen.

 

There are a couple contributions that allow you to run osCommerce with register_globals set to off.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below.
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...