חזרה ללוח
D37אומת בקודP0
Hardcoded payment bypass: `cc_id == 317330009` marks order paid with no charge
C · authS3 · destructiveSECT1
תיקון
מורכבות low95%
A hardcoded magic value lets an order be marked paid with no actual charge.
Checkout.php:490
תיק מלא
ממצאים קשורים
D13 · God-router: no nonce + no capability …D39 · Stored XSS: buyer `full_name` unescap…D40 · Stored XSS in admin dashboards (guest…D63 · Raw `session_start()` on init after o…D17 · Payment cURL TLS certificate verifica…D18 · Payment cURL has no connect/read time…D19 · Raw gateway response + full `$_SERVER…D56 · Freebie threshold `intval($sum)<=1` s…D91 · Commented-out hardcoded Tranzila pass…