Clickbank order details in plain view

Post by jarito » Wed, Jun 19, 2013, 10:03 PM UTC

pchap10k wrote: post #32

freehunter wrote: post #13

Earlier quoted context omitted.

There's no payment card information besides what's acceptable to show (last four and card type). Full name and email address is PII, but not necessarily in breech of PCI. I don't believe SOX has anything specifically mentioning full name and email PII either. If that's the case, the only thing that would make it a PCI or SOX violation is if the company says in their data privacy policy that they will protect this PII…

Cardholders name is PCI data. So in most cases the customer?s name and the cardholders name would fall under the auspices of PCIDSS. This is definitely a breach.

Post by mmanfrin » Wed, Jun 19, 2013, 10:09 PM UTC

Lutinger wrote: post #21

frogpelt wrote: post #14

Earlier quoted context omitted.

First relevant result refers to the fact that customer's info is available for public viewing. https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...

And this customer support ticket shows a customer complaining about the fact that their order information is visible on the internet. This was back in 2011. ClickBank has to have known about this hole for years and hasn't addressed it. https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...

Post by JeremyMorgan » Wed, Jun 19, 2013, 10:28 PM UTC

Post by rdouble » Wed, Jun 19, 2013, 10:31 PM UTC

Post by meowface » Wed, Jun 19, 2013, 10:46 PM UTC

rdouble wrote: post #47

I interviewed for a hedge fund once where my job interview was to write a program that exploited a security flaw like this to make a real time model of what people were paying for diamonds.