PCI Compliance?

Status Fail (This must be resolved for your device to be compliant).
Plugin "Non-persistent Cross-Site Scripting Vulnerability"

Category "CGI abuses : XSS "

Priority "Medium Priority
Description The following CGI script seem to be vulnerable to XSS non-persistent hole : /index.php
Unsafe arguments : keyword

Unsafe URLs : /index.php?keyword=%2bADw-%2ftitle%2bAD4APA-script%2bAD4-alert(12345)%2bADs
APA-%2fscript%2bAD4&route=product%2fsearch (XSS pattern: +ADw-/title+AD4APA-script+AD4-alert(12345)+ADsAPA-/script+AD4)

An attacker may change 'Content-Type' and 'Charset' for dinamically generated site, include some script in UTF-7 into the page header and execute it for destructive actions


Risk factor Medium / CVSS Base Score : 4.3

Solution
always set 'Content-Type' and 'Charset' for html page via 'meta' tag before any changeable info

Qphoria wrote:

Xsecrets wrote:

Code: Select all

if (isset($this->request->post['redirect'])) {
                if(strpos($this->request->post['redirect'], HTTP_SERVER) === false){
                    $redirect_error = true;
                } elseif(strpos($this->request->post['redirect'], HTTPS_SERVER) === false) {
                    $redirect_error = true;
                } else {
                    $redirect_error = false;
                }
                if($redirect_error == true){
                    $this->redirect(HTTP_SERVER . 'index.php?route=common/home');
                } else {
                    $this->redirect($this->request->post['redirect']);
                }
            } else {
                $this->redirect(HTTP_SERVER . 'index.php?route=common/home');
            }
 

It's late here and maybe I'm not seeing it.. but couldn't this be simplified to just:

Code: Select all

if (isset($this->request->post['redirect']) && strpos($this->request->post['redirect'], HTTP_SERVER) !== false) {
    $this->redirect($this->request->post['redirect']);
} else {
    $this->redirect(HTTP_SERVER . 'index.php?route=common/home');
}
 

    protected function redirect($url, $status = 302,$outside = false) {
        if ($outside) {
            header('Status: ' . $status);
            header('Location: ' . str_replace('&', '&', $url));
            exit();
        }
        $go = @parse_url($url,PHP_URL_HOST);
        $http = parse_url(HTTP_SERVER,PHP_URL_HOST);
        $https = parse_url(HTTPS_SERVER,PHP_URL_HOST);
        if (strripos($go,$http) === 0 OR strripos($go,$https) === 0) {
            header('Status: ' . $status);
            header('Location: ' . str_replace('&', '&', $url));
        } else {
            header('Status: 404');
            header('Location: ' . $this->url->link('error/not_found'));
        }
        exit();
    }
 

PCI SSC makes no endorsement or recommendation of applications or products, or of their respective developers or distributors. Furthermore, PCI SSC makes no warranties, guarantees or representations that any of the applications or products will meet your requirements for performance or functionality, that the applications or products will be free from errors or malicious code, or that the applications or products will be compatible with any other systems or applications. Any and all representations or warranties, including any and all representations and warranties made by the payment application vendor, are disclaimed by PCI SSC.

Use of any one or more of the applications below (i) does not guarantee or ensure compliance with the PCI DSS or PA-DSS; and (ii) does not satisfy any Acquirers' obligations to perform their own evaluations and due diligence, to ensure the PCI DSS or PA-DSS compliance of their merchants or service providers.

There are two or three tweaks that I see need to happen from Daniel and his group at OPENCART to make this viable and 100% compliant cart solution. Joomla and WordPress are the same.