09 - Insecure Order Form :)

Przemolog · 19-01-2006, 20:59

Here we place an order (incl. credit card data):
http://www.09.is/orderform.php

And here is the action URL used after the form is submitted:
http://www.09.is/orderform_process.php

Moreover, it's possible to submit the form with any contents, even EMPTY, without any client- or server-side validation! All what is displayed is:

Form submitted...

Thank you !

What the hell is that??? :umm:

	(#1)
Przemolog (Offline) Senior Member Prepaid Guru Posts: 1,211 Join Date: 06 Feb 2005 Location: Swidnik-home, Lublin-work Country:	19-01-2006, 20:59 Here we place an order (incl. credit card data): http://www.09.is/orderform.php And here is the action URL used after the form is submitted: http://www.09.is/orderform_process.php Moreover, it's possible to submit the form with any contents, even EMPTY, without any client- or server-side validation! All what is displayed is: Form submitted... Thank you ! What the hell is that??? :umm: