Unauthenticated Stripe Payment Bypass in /api/stripe/processed

漏洞关键信息总结 漏洞概述 类型：未认证支付绕过（Unauthenticated Payment Bypass） 位置： 端点 问题：Stripe 成功重定向端点 允许未认证用户通过查询参数 授予账户积分，且未与 Stripe 验证支付状态。攻击者可构造请求，在 参数中嵌入任意 ，从而以攻击者选定的金额免费获得积分。 影响范围 受影响文件： - - - 影响：未认证用户可绕过支付验证直接获取积分，造成资产损失。 修复方案 1. 要求认证会话：在 中要求已认证会话，并验证重定向用户与支付码（owner check）。 2. 与 Stripe 验证支付状态：通过 获取支付状态，仅当状态为 且 匹配预期金额时才授予积分，否则拒绝。 3. 持久化 payment_id：在 中新增 方法，将 Stripe Checkout Session ID 与支付码关联存储，便于后续验证。 4. 数据库迁移：为 表新增 字段（ ）。 关键代码（POC/修复代码） 1. 验证会话与支付码归属（Stripe.php） 2. 与 Stripe 确认支付已完成（Stripe.php） 3. 持久化 payment_id（StripeWebhook.php） ```php / Store the Stripe Checkout Session Id for a payment so the success redirect can verify the payment status against Stripe before granting credits. @param string $code Payment code @param string $paymentId Stripe Checkout Session Id @return bool success status / public static function setPaymentId(string $code, string $paymentId): bool { try { $conn = self::getPdoConnection(); $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET payment_id = ? WHERE code = ?', [ $paymentId, $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'paid', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self::TABLE_NAME . ' SET status = ? WHERE code = ?', [ 'code', $code ]); return $conn->exec('UPDATE ' . self

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated Stripe Payment Bypass in /api/stripe/processed

More from this source