Full Disclosure mailing list archives
CCBILL.COM Internet billing service multiple vulnerabilities
From: Vulnerabilities <vuln () ariko-security com>
Date: Tue, 17 Aug 2010 01:19:55 +0200
We want to warn you about security vulnerabilities in CCBILL.COM Internet billing service. CCBill is an Internet billing service. Established in 1998, the company provides third-party billing, or turn-key solutions, for e-Merchants requiring payments by way of credit card, debit card, or e-check, European Debit/Direct Pay, and telephone payment. Since Ccbill is a privately held company little is known about it's finances however it is estimated that more than a billion dollars per year in credit card charges are processed through Ccbill in the us and abroad. Time Table: # 20/07/2010 We have found multiple Blind SQL injections. # 30/07/2010 - Vendor notified. / no response # 03/08/2010 - Vendor notified. / no response # 10/08/2010 - Vendor notified. / no response CCBILL.COM vulnerability: Multiple blind SQL injections It's possible to get all customers FULL personal details, server admins etc... Also is possible to read any file from ccbill.com and write to this server too. JPG sample tables proof: http://www.ariko-security.com/images/ccbill_proof1.jpg Credit: # Discoverd By: MG / Ariko-Security 2010 # http://advisories.ariko-security.com/august/audyt_bezpieczenstwa_719.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- CCBILL.COM Internet billing service multiple vulnerabilities Vulnerabilities (Aug 16)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities Jeffrey Walton (Aug 16)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities Michal Zalewski (Aug 16)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities mrx (Aug 16)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities Michal Zalewski (Aug 16)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities Jeffrey Walton (Aug 16)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities Michal Zalewski (Aug 16)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities Jeffrey Walton (Aug 16)
- <Possible follow-ups>
- Re: CCBILL.COM Internet billing service multiple vulnerabilities William Bell (Aug 17)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities Vulnerabilities (Aug 17)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities PsychoBilly (Aug 17)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities Michael Holstein (Aug 17)
- Re: CCBILL.COM Internet billing service multiple vulnerabilities Vulnerabilities (Aug 17)