OpenCart 1.5.x and PayPal Standard Vulnerability Discovered

[antropy]

I thought it might be worth a post to let people know in this forum that there's a potential issue with PayPal Standard in OpenCart 1.5.x where customers can adjust the total amount to be paid before they're sent off to PayPal.

This means that the order will still come in to OpenCart successfully but perhaps only 1p will have been paid. Unless the store owner also checks their PayPal balance, they may not realize what's happened until it's too late and may ship the order anyway.

We have released an extension that fixes the issue here:
http://www.opencart.com/index.php?route=extension/extension/info&extension_id=22893

 

[sb65]

Is this bug documented somewhere?

 

[antropy]

Is this bug documented somewhere?

A lot more info here: http://www.antropy.co.uk/blog/paypal-standard-hack-causes-wrong-order-total-in-opencart-1-5-x/

 

[willv]

Sounds like a pretty serious bug, thanks for the heads up. I'll have our developer confirm this weekend and pick up your extension.