CODEWITHSUNDEEP
phpprestashoppayment-gatewayprestashop-1.6
Report Gladiatech
Report Gladiatech

Reputation: 59

Prestashop 1.6 Amount Tampering While Check Out

I have a shopping cart built in Prestashop 1.6 and I have integrated HDFC Payment Gateway in it . After an security audit the bank told me "The test found one high-risk vulnerability (i.e. Amount Tampering)". Resolution- Kindly maintain the session.

I had not coded anything as Prestashop 1.6 is in built CMS and neither did i do anything with the HDFC payment gateway as they provided a pre built code from their end which is developed using Prestashop 1.6. I just installed the module from backend.

The Problem

  1. Added one item to the cart and checked out. (eg - 400 USD)
  2. On the 3rd party hdfc payment gateway page i didn't process with the payment.
  3. Opened another tab and added few more items (eg - 400 USD + 300 USD)
  4. Now back to point 2 and i processed with the amount for 400 USD and paid.
  5. In my admin panel its showing paid for 400 USD + 300 USD and two items are bought by the customer .

I have no idea how to solve this Amount related issue.

I am a newbie in Prestashop and Payment Gateway Integration.

Upvotes: 2

Views: 168

Answers (1)

Bruno Leveque
Bruno Leveque

Reputation: 2811

The best practice with payment processing is always to double-check that the amount sent back by the bank after the payment was processed is perfectly matching with the amount of the related shopping cart in your local (PrestaShop) database.

Here's a simplified flow chart:

PrestaShop / HDFC flow chart

In case you do not have programming skills, I would suggest to kindly refer to the module's developer so he/she can address that security issue.

Upvotes: 2

Related Questions