Zen Cart Logo
Forums / Reports of Security Problems / Customers changing price when checking out?

Customers changing price when checking out?

Views: 28

Results 1 to 3 of 3
16 Jan 2010, 2:48 AM
#1
jamestim avatar

jamestim

New Zenner

Join Date:
Jan 2010
Posts:
5
Plugin Contributions:
0

Customers changing price when checking out?

I have the latest version of Zen Cart and am fully patched up. Recently I saw an order come through with GV as the payment method (we don't accept GV). The customer was contacted and were adamant that they had selected direct deposit or credit card.

My developer suspected the checkout could be vulnerable to customers using tools like firebug to change pricing/shipping amount/payment method when checking out. For example - http://www.thedigeratilife.com/blog/index.php/2006/11/30/how-to-buy-a-playstation-3-for-099/. I know this is highly unlikely as Zen Cart should have checks against this sort of thing, but can someone confirm it for me? Can a user manipulate the price that is being sent to the server?

16 Jan 2010, 7:36 AM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
177

Re: Customers changing price when checking out?

JamesTIM:

I have the latest version of Zen Cart and am fully patched up. Recently I saw an order come through with GV as the payment method (we don't accept GV).
Um ... what does "came through with GV" have to do with "changing price when checking out"?
You seem to be mixing topics.

As far as GV being applied for payment when the customer allegedly chose a different module, that has been reported to occur when storeowners choose to set modules to "enabled=false" instead of clicking "Remove" to completely skip potential handling by those modules.
Do you have any payment modules active but with "enabled=false"? If so, click Remove on them.

That may or may not resolve your problem, but it is worth mentioning as Best Practice.

As to customers changing prices, I don't see where you're reporting that to have actually happened.

16 Jan 2010, 8:08 AM
#3
jamestim avatar

jamestim

New Zenner

Join Date:
Jan 2010
Posts:
5
Plugin Contributions:
0

Re: Customers changing price when checking out?

My apologies if I wasn't clear. The issue or risk of a customer changing prices was raised after the GV event occurred. This is what got us thinking about security. That link I was posted was from a Google search, and I was seeking confirmation that Zen Cart is not vulnerable as per that example given.