Clickbank order details in plain view

Direct search link: https://www.google.com/search?q=site%3Aclkbank.com%2ForderDe...

Well, this is pretty egregious and makes me rather happy I don't use them. From the looks of things you can also change the email associated with an order and send yourself the info all over again. This means for some things, like online services or say application licenses, you can resend the info to yourself and probably steal the actual customers product.

Additionally, I'm willing to bet quite a few of these people have used the listed email and last 4 for other things online and/or for verification of identify places.

Also, how is this PCI compliant?

The problem was that some average developer was lazy and do whatever that worked, with no concern about potential security implications.

I hate LMGTFY. It's slow and condescending, especially for something like this where slow and condescending don't add anything. Is it not possible to just submit a Google search link? Or use a text-only post?

WTF is a .htm file, I'm feeling all nostalgic, I haven't seen one of those in a decade. I wonder what version of CGI those developers are using.

Seriously though, wow! that's really awful.

It looks like their customer service ticketing system is wide open too:

http://www.google.com/search?q=www.clkbank.com/viewTicket.ht...