A flaw in the business logic of the gift card purchasing function on sears.com. The flaw was with the verification functionality which allowed an attacker to script thousands of gift card requests. The function relied on client side cookies to prevent brute force attacks – doh!
Such a flaw would not be uncovered by automated scans or automated code review. So ASVS Level 1A or 1B would not be sufficient!
Human intervention, data flow analysis and business logic review from a security standpoint coupled with manual testing may of uncovered such an issue.
read more on here
Post Tags:
