My recent PCI scan has failed with some new issues of which I have no idea how to address.

ECT v7.9.1
PHP 8.3.28

Thanks, Patrick


#1 Threat
Insecure configuration of Cookie attributes
Impact
A Cookie Vulnerability helps an attacker to gain access to session information stored in cookies. It may also be used as a 'locator' attack that precedes a Cross-Site Scripting (XSS) or Man-In-The-Middle attack. When looking for Cookie Vulnerabilities, an attacker will first observe cookies through various HTTP proxies and check their attributes. The attacker will then try to steal cookies of various users by employing multiple attacks. If successful, he/she may be able to get sensitive information which can be further used in an illegitimate way.
Solution
It is important to set Secure and HTTPOnly flags for all the cookies on the application. The Secure flag prevents cookies from being transmitted over clear text. An HTTPOnly flag would limit cookie access in cases of Cross-Site Scripting issues. Proper Caching headers should be set for responses carrying the cookie. Cookies set on the client side should also contain Secure and HTTPOnly tags.

DetectionDetails: Cookie Vulnerabilities Found
ecttestcart = 2464
Path = /
Host = www.mywebsite.com
Cookie does not have an HTTPOnly Attribute
Cookie Change Observed on CLIENTside

Request: GET https://www.mywebsite.com/index.php HTTP/1.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Cookie: ECTTESTCART=2464; ectcartcookie=c83e9522f4223712a06e52b308; PHPSESSID=t1ah2c0c0vpdh2oi8ukleit2r3

location: https://www.mywebsite.com/index.php


#2 Threat
Boolean Based SQL Injection Vulnerability
Impact
A SQL injection vulnerability (SQLi) was identified in this web application. SQL injection is when modified SQL syntax is supplied to a user defined parameter to have it query the SQL database directly, which is not the desired intent of the web application. A simple proof of concept example of this would be for a user to supply "' or SELECT DATABASES;--" to a user defined parameter and then upon submission, a list of databases on the system would be supplied for the user because the SQL query was interpreted directly on the SQL server instance. SQL injection can be found in many different forms and combinations so the full request and response that was used demonstrate this vulnerability has been provided below as evidence.

DetectionDetails: Boolean based SQL vulnerability found
GET - https://www.mywebsite.com/proddetail.php?prod=Slixprings-Main-Hammer-Spring-Installation-Instructions+and+2371%3D5793+%2F* - prod
False Injection: Slixprings-Main-Hammer-Spring-Installation-Instructions and 2371=5793 /*
True Injection: Slixprings-Main-Hammer-Spring-Installation-Instructions and 5647=5647 /*
True and false injections produced different responses


#3 Threat
Server Banner Disclosure
Impact
Many times server banner includes a version number of the server or the technology used. Information of known security issues for particular versions of servers are available on various security forums. Even if such version number is not present, knowing the server or technology may help the attacker to perform more focused attacks.
Solution
Always configure the web servers to not disclose more information about the server from the response headers

DetectionDetails: Found Server banner with no version information.

GET https://www.mywebsite.com/vsadmin/admin.php
Server: nginx

Request: GET https://www.mywebsite.com/vsadmin/admin.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Referer: https://www.mywebsite.com/vsadmin/

location: https://www.mywebsite.com/vsadmin/admin.php

#1 - This is a test cookie being set just to check if the user-agent supports cookies and does not contain any sensitive data. All other front-end cookies are set as HTTPOnly cookies. If you need to modify the code to address this then you will need to open vsadmin/inc/inccart.php in a code editor like Visual Studio Code (free to download), searching for "ECTTESTCART" in the document, and then comment out the following 3 lines with two forward slashes ('//'):



The result should look like this:



Once those lines are commented out, you can save and upload inccart.php to the vsadmin/inc/ on your web server.

#2 - I don't believe there is an actual vulnerability here, but it does look like there are some possible issues with third-party modifications when the product is not found. You will need to contact the mod developers for assistance with fixing these.

#3 - The Server Banner issue has to do with your web hosting configuration and not the shopping cart software. You will need to address that with your hosting provider directly.

Daniel Ewers
DRAYE Solutions
draye-sol.com

Daniel,

Thank you so much for that insight.

#1 was commented out as you suggested and passed the next scan.

#2 & #3 were false positives.

Thanks again.

Patrick