Ecommerce Security Checklist: Order, Payment, Comment 2023
The validation value of the cookie is too simple. Some web pages are too single or simple to generate cookies, which leads to hackers being able to enumerate the validity values of cookies. Or you can log in to other use... Read Logical Exploits Of Flaws In a Cookie/Token Design
Purchase Payment/Recharge
- Order information traversal/disclosure
- Leakage of order information leads to leakage of user information
- Unauthorized modification/deletion of other people's orders
- Commodity amount/quantity tampering
- Replace the payment module
- Leakage of transaction information
- False recharge amount
- Recharge account/amount/quantity tampering
- Payment Verification Bypass
- Integer overflow, the maximum value of int is 2147483647
- Modify the key value in the data packet returned by the local JS or the server
Comment
- POST injection
- No session/token leads to CSRF
- Insert XSS when commenting
- Traversing the user ID leads to user information leakage
- The number of malicious batch-brushing comments.
- Ecommerce Security Checklist: User, Membership
- Ecommerce Security Checklist: Order, Payment, Comment
- Ecommerce Security Checklist: Sweepstakes, Coupon
- Ecommerce Security Checklist: Third-Party System, Captcha
- Logical Exploits Of Captcha
- Logical Exploits Of SMS Bombing
- Logical Exploits Of Operation Beyond Authority
- Logical Exploits Of User Information Disclosure
- Logical Exploits Of Order Amount
- Logical Exploits Of Unauthorized Access
- Logical Exploits Of Unlimited Enumeration
- Logical Exploits Of Flaws In a Cookie/Token Design
- Logical Exploits Of Contract Vulnerability
- Logical Exploits Of Membership Upgrade
- Logical Exploits Of Order, Payment
- Logical Exploits Of Integer Overflow
- Logical Exploits Of Frontend Validation, Time Limit
- Logical Exploits Of Brute Force, Password Recovery
- Logical Exploits Of Arbitrary URL Jump
- Payment Logic Vulnerability of E-Commerce
Sweepstakes/PromotionVoucher/Coupon Sweepstakes/Promotion - random draw- Stolen prizes/points- Tampering with lottery points/times- concurrent lottery- Invitation code XSS (Verification code URL may contain user name, the ...
Login - brute force- Any user/password login- SMS/email bombing- Captcha bypass/blasting/replay/postback- Username/Mobile Number Enumeration- Unauthorized login (such as modifying the user ID in the data packet)- Account p...